Towards Identifying Internet Applications Using Early Classification of Traffic Flow

Abstract

Network traffic classification has been an interesting topic of research for many years. It plays a crucial role in many network applications including resource allocation, intrusion detection, and quality of service. Network traffic is essentially a sequence or flow of time-stamped packets that are exchanged between two devices. The traffic flow also contains payload data along with information about packet statistics such as size, inter-arrival time, and direction. As these statistics are obtained from the time-stamped packets, they form a Multivariate Time Series (MTS). Such an MTS needs to be classified as early as possible to identify an Internet application associated with the generated traffic flow. In this paper, we propose an Early traffic Flow Classification (EFC) approach for identifying Internet applications using MTS. The approach estimates application-wise minimum required packets from the training data by employing k-means clustering and Long Short Term Memory model. We also develop a class forwarding method to utilize correlation that exists among different packet statistics. Additionally, we collect a real-world traffic flow dataset to evaluate the effectiveness of the approach. Experimental results show that EFC approach requires only the first 15 packets of the flow to achieve an accuracy of more than 90%.