Open AccessFlow Feature-Based Network Traffic Classification Using Machine Learning
Author(s) -
Nicolas Airoza Telles de Menezes,
Fernando Machado de Mello
Publication year - 2021
Publication title -
journal of information security and cryptography
Language(s) - English
Resource type - Journals
ISSN - 2595-5217
DOI - 10.17648/jisc.v8i1.79
Subject(s) - traffic classification , computer science , payload (computing) , cluster analysis , data mining , artificial intelligence , machine learning , network packet , feature (linguistics) , deep packet inspection , encryption , port (circuit theory) , the internet , set (abstract data type) , traffic flow (computer networking) , computer network , engineering , linguistics , philosophy , world wide web , electrical engineering , programming language
Reliable network traffic classification is essential to management and security tasks. Therefore, it is beneficial to analyze and improve existing techniques. Some of the most traditional methodologies for traffic classification are based on port number and packet payload, each of which presents an increasing set of problems. Port number-based classification techniques suffer from the misuse of port numbers and tunneling. This is primarily due to their reliance on the proper use of IANA (Internet Assigned Numbers Authority) assigned numbers. On the other hand, packet payload-based classification has difficulty dealing with encrypted data and legal restrictions to accessing user data. Flow feature-based classification canovercome these challenges by creating profiles based on the traffic patterns of applications. Furthermore, machine learning techniques have shown to be a good match for traffic classification. Thus, the goal of this paper is to explore the combination of these fields and to develop a set of machine learning models capable of classifying network traffic based on flow features. This was achieved by using a ready to use dataset to train two supervised and one unsupervised clustering model.The results for the supervised classifiers were considered comparable to similar studies, while the performance of the clustering model was found to be not satisfactory.