An application traffic classification method based on semi-supervised clustering

Abstract

Accurate traffic classification is critical in network security monitoring and traffic engineering. To overcome the deficiencies of traditional traffic classification methods with port mapping and signature matching, several machine learning techniques were proposed. However, there are two main challenges for classifying network traffic using machine learning method. Firstly, labeled samples are scarce and difficult to obtain. Secondly, not all types of applications are known a priori, and new ones may appear over time. To address the abovementioned problems, This paper proposed a semi-supervised classification method that allows classifier to be designed from training dataset consisting of a few labeled and many unlabeled samples. This method consist two steps: Particle Swarm Optimization (PSO) clustering algorithm was employed to partition a training dataset that mixed few labeled samples with abundant unlabeled samples. Then, available labeled samples were used to map the clusters to the application classes. Two host features: IP Address Discreteness and Success Rate of Connections had been proposed and used in this paper. Experimental results using traffic from campus backbone show that high classification accuracy can be achieved with a few labeled samples. © 2010 IEEE.