A Comparative Study on Network Traffic Clustering

Abstract

Accurate network traffic classification is vital to the areas of network security. There are many applications using dynamic ports and encryption to avoid detection, so previous methods such as port number and payload-based classification exist some shortfalls. An alternative approach is to use Machine learning (ML) techniques. Here we will present three clustering algorithms, K-Means, FarthestFirst and Canopy, based on flow statistic features of applications. The performance impact of the data set processed by the PCA dimension reduction algorithm on the above three algorithms will be an important topic for our discussion. Our results show that the classification accuracy and computational performance all have been significantly improved after dimension reduction.