Evaluating machine learning algorithms for automated network application identification

The identification of network applications that create traffic flows is vital to the areas of network management and surveillance. Current popular methods such as port number and payload-based identification are inadequate and exhibit a number of shortfalls. A potential solution is the use of machine learning techniques to identify network applications based on payload independent statistical features. In this paper we evaluate and compare the efficiency and performance of different feature selection and machine learning techniques based on flow data obtained from a number of public traffic traces. We also provide insights into which flow features are the most useful. Furthermore, we investigate the influence of other factors such as flow timeout and size of the training data set. We find significant performance differences between different algorithms and identify several algorithms that provide accurate (up to 99% accuracy) and fast classification. Keywords—Traffic Classification, Machine Learning, Statistical Features I. INTRODUCTION There is a growing need for accurate and timely classification of network traffic flows for purposes such as trend analyses (estimating capacity demand trends for network planning), adaptive, network-based QoS marking of traffic, dynamic access control (adaptive firewalls that detect forbidden applications or attacks) or lawful interception. 'Classification' refers to the identification of an application or group of applications responsible for a traffic flow. Port-based classification is still widely practiced despite being only moderately accurate at best. It is expected to become less effective in the near future due to an ever-increasing number of network applications, extensive use of network address translation (NAT), dynamic port allocation and end-users deliberately choosing non-default ports. For example a large amount of peer-to-peer (p2p) file sharing traffic is found on non- default ports (1). Alternative solutions such as payload- based classification rely on specific application data (protocol decoding or signatures), making it difficult to