Cyberspace Safety and Security

Abstract

Recent research on Internet traffic classification has achieved certain success in the application of machine learning techniques into flow statistics based method. However, existing methods fail to deal with zero-day traffic which are generated by previously unknown applications in a traffic classification system. To tackle this critical problem, we propose a novel traffic classification scheme which has the capability of identifying zero-day traffic as well as accurately classifying the traffic generated by pre-defined application classes. In addition, the proposed scheme provides a new mechanism to achieve fine-grained classification of zero-day traffic through manually labeling very few traffic flows. The preliminary empirical study on a big traffic data show that the proposed scheme can address the problem of zero-day traffic effectively. When zero-day traffic present, the classification performance of the proposed scheme is significantly better than three state-of-the-art methods, random forest classifier, classification with flow correlation, and semi-supervised traffic classification. © Springer International Publishing Switzerland 2013.