Network traffic classification using ML: a comparative analysis

Abstract

Traffic Classification methods aim for the automation of processes of analysis and categorization of traffic flowing through a network according to its intrinsic nature and characteristics. In its first iterations, traffic classification took advantage of aspects such as port numbers and payload analysis for categorization, however, due to the fast-growing and changing nature of the Internet, such methods became ineffective. Thus, the necessity for newer and more effective forms of traffic classification persists. Recently, Machine Learning (ML) techniques have proven to be an effective tool for analyzing and categorizing traffic within the context of modern networks, however, a number of issues can still emerge when evaluating the effectiveness of such methods in a real-world context. Issues such as overall classification throughput of ML algorithms, classification accuracy and precision, the integrity and/or representativeness of the datasets used in the training phase are important aspects of accessing the effectiveness of ML as a traffic classification method. The present paper analyses and compares a comprehensive set of studies and surveys covering the subject of ML as a tool for traffic classification. Our approach compares the data characteristics used for evaluating the effectiveness of ML algorithms, namely traffic classification in the context of a live network, and discusses issues concerning the creation and usage of datasets to train the ML algorithms so that their future application in real-time traffic can be similar to the results obtained during offline testing.