ORCID
- Ghita, Bogdan: 0000-0002-1788-547X
Abstract
Network traffic classification is a vital task for service operators, network engineers, and security specialists to manage network traffic, design networks, and detect threats. Identifying the type/name of applications that generate traffic is a challenging task as encrypting traffic becomes the norm for Internet communication. Therefore, relying on conventional techniques such as deep packet inspection (DPI) or port numbers is not efficient anymore. This paper proposes a novel flow statistical-based set of features that may be used for classifying applications by leveraging machine learning algorithms to yield high accuracy in identifying the type of applications that generate the traffic. The proposed features compute different timings between packets and flows. This work utilises tcptrace to extract features based on traffic burstiness and periods of inactivity (idle time) for the analysed traffic, followed by the C5.0 algorithm for determining the applications that generated it. The evaluation tests performed on a set of real, uncontrolled traffic, indicated that the method has an accuracy of 79% in identifying the correct network application.
DOI
10.1155/2019/5758437
Publication Date
2019-08-20
Publication Title
Journal of Computer Networks and Communications
Volume
2019
First Page
1
Last Page
10
ISSN
2090-7141
Embargo Period
2021-12-08
Organisational Unit
School of Engineering, Computing and Mathematics
Recommended Citation
Oudah, H., Ghita, B., Bakhshi, T., Alruban, A., & Walker, D. (2019) 'Using Burstiness for Network Applications Classification', Journal of Computer Networks and Communications, 2019, pp. 1-10. Available at: https://doi.org/10.1155/2019/5758437
