Traffic classification method by combination of host behaviour and statistical approach

Abstract

Traffic classification, one of the most active fields in Internet traffic research, is the substructure of network design and management. Generally, there are four techniques to identify the traffic, port-based, payload-based, flow statistic-based, and host-based approaches. In this paper, a hybrid method to classify the traffic was proposed combining the host behaviour and the Affinity Propagation (AP) algorithm. Simple features in the statistical process were selected at the first stage of classification; then, the initial classification results and the host behaviour model were combined to generate the final results. The host behaviour model was updated by the feedback of previous classification. The combining classification approach was evaluated on two real traces. The results indicated that the proposed technique offered improved performance compared with BLINC and independent AP algorithms. © 2014 Kavala Institute of Technology.