Early traffic classification using support vector machines

Abstract

Internet traffic classification is an essential task for managing large networks. Network design, routing optimization, quality of service management, anomaly and intrusion detection tasks can be improved with a good knowledge of the traffic. Traditional classification methods based on transport port analysis have become inappropriate for modern applications. Payload based analysis using pattern searching have privacy concerns and are usually slow and expensive in computational cost. In recent years, traffic classification based on the statistical properties of flows has become a relevant topic. In this work we analyze the size of the firsts packets on both directions of a flow as a relevant statistical fingerprint. This fingerprint is enough for accurate traffic classification and so can be useful for early traffic identification in real time. This work proposes the use of a supervised machine learning clustering method for traffic classification based on Support Vector Machines. We compare our method accuracy with a more classical centroid based approach, obtaining promising results.