Gang Lu＊, Ronghua Guo, Ying Zhou, Jing Du

Chinese Luoyang electronic equipment center, Luoyang 471003, China

I. INTRODUCTION

Accurate traffic classification is fundamental to network management. According to the results of traffic classification, Internet Service Providers (ISP) can optimize network resources,billing for specific applications and enforce security policies. However, due to an increasing number of new applications in today’s IP networks and complex communications among them, it is difficult to correctly classify traffic flows into specific network applications.

Traditional traffic classification methods,such as signature-based classification, cannot identify encrypted payloads. Moreover, some privacy laws forbid administrators to inspect packet payloads. In order to address those issues, Machine Learning (ML) based classifiers using flow statistics have been proposed.They are applied in identifying encrypted applications since flow statistics are derived from packet headers. Furthermore, they are able to identify unknown applications as well by grouping the previously unseen examples into new clusters. However, class imbalance and discriminator bias problems challenge ML based traffic classification. In the case of class imbalance, ML traffic classifiers achieve low accuracies in identifying the applications whose number of flows is minority in the training dataset. For example, ML based classifiers are prone to achieve low accuracy for Skype since the number of Skype flows is much smaller than that of other application flows, such as HTTP. On the other hand,Skype traffic is especially of great interest for ISP since ISP usually applies an efficient pricing for the rapidly spreading Skype.

Discriminator bias is the other challenge of ML based traffic classification. It corresponds to the problem that the flow-level discriminators can improve classification accuracies of some applications while reducing the accuracies of other applications. The problem always occurs in the case of multi-class classification.The present feature selection algorithms are helpless for this problem since they usually select the features making the overall accuracy highest but probably sacrificing the accuracies for some applications. To the best of our knowledge, no exact solution for the discriminator bias problem is found.

In this article, an accurate and extensible cascaded traffic classifier is proposed. It is built based on a cascade of sub-classifiers.

To address the above two issues and have a better classification result, we propose an accurate and extensible ML traffic classifier.The intuition is to split the classification process of flows into several stages. In each stage,an application specific binary sub-classifier using the flow-level discriminators of that application is applied. Specifically, the classification result of each binary sub-classifier is“a specific application” or the label “others”.All these binary sub-classifiers are organized in an optimized cascade for maximizing the classification accuracy. The main advantages of our classifier lie in: (i) the proposed classifier can discover the new application flows once all the binary sub-classifiers cannot map those flows with their identified applications.(ii) The classifier can identify encrypted applications by using both packet sizes and packet sequences. (iii) It can extract the key discriminators for each application and adjust the binary sub-classifier to achieve satisfied accuracy of a specific application. (iv) It is easy for the classifier to be extended for identifying new applications.

The contributions of this work are summarized as follows:

● To address the discriminator bias problem,we propose an accuracy and extensible ML traffic classifier. Moreover, we can present the optimal discriminators for each application after training the ML classifier.

● To address the class imbalance problem, we

apply SMOTE algorithm to create the artificial samples for minority classes on the training datasets. Experimental results show that the approach can improve the classification accuracy for the minority classes.

● We evaluate the novel classification algorithm with two public traffic traces and validate its performance from both theoretical and empirical aspects.

The rest of this paper is organized as follows. Section 2 presents an overview about related work. In section 3, we elaborate our traffic classification approach in detail. Section 4 presents the evaluation and experimental results. Finally, section 5 concludes our paper.

II. RELATED WORK

ML based traffic classification involves two key steps: the analysis of traffic discriminators and the design of traffic classifiers. In this section, we first review the related work for the analysis and processing of traffic discriminators in Subsection 2.1. Then, the class imbalance problem in learning traffic classifiers is introduced in Subsection 2.2.

2.1. Traffic discriminators

The classification abilities of different traffic discriminators are evaluated in many related works. Moore et al. [1] comprehensively analyzed flow-level statistical discriminators in traffic classification, and found that feature selection is important in traffic classification [2].Lim et al. [3] denoted that feature discretization is vital to improve traffic classification accuracy. Based on this study, Zhang et al. [4][5]incorporated flow correlation into the Naïve Bayes (NB) based classifiers with feature discretization. Raveendran et al. [6] proposed entropy based minimum description length discretization method. Palmieri et al. [7] analyzed non-stationary “hidden” transition patterns of IP traffic flows. They [8] further applied wavelet analysis in discovering time regularities of the traffic. The recent work [9] studied how to extract traffic discriminators for a real-time intrusion detection system. Actually, Bernaille et al. [10] denoted that the size and direction of the first data packets of a TCP connection are expressive enough to distinguish among different applications. They further performed early traffic classification [11]. Este et al. [12]evaluated the amount of information carried by traffic flow features and found that the mutual information between packet size and application protocol remains stable on different datasets. Li et al. [13] analyzed the temporal and spatial stability of traffic statistical features as well. Lu et al. [14] recently proposed the packet size distribution classifier and the packet size sequence classifier. Peng et al. [15]applied data gravitation based classifier in traffic classification by using packet sizes.

The previous researches [1-15] mainly focused on the how to extract and apply traffic discriminators in traffic classification. However, it ignored the discriminator bias problem in which some discriminators improve the accuracies of some applications but reduce the accuracies of the other applications. To address the discriminator bias problem, a feasible solution is to set up several classifiers, each of which is used for identifying the application with its discriminators. Grimaudo et al. [16]proposed hierarchical learning scheme that is similar to ours but different in essence. Their classifier is organized in a tree-based structure,where each node is an independent classifier.They applied “minimum-Redundancy-Maximum-Relevance” algorithm for selecting the discriminators of each application. Their classifier is used for fine grained Internet traffic classification. Although we apply the independent binary sub-classifier for each application as well, we build an optimal cascade of those binary sub-classifiers for improving the classification precision. Moreover, we apply wrapper feature selection schema that selects the discriminators of each application by considering the optimal combination of both the binary sub-classifier and discriminators.

2.2 Class imbalance problem

Although lots of machine learning algorithms[17,18,19] have been applied in Internet traffic classification, the class imbalance problem in Internet traffic data has been challenging.Class imbalance problem occurs when the application categories in Internet traffic are not equally represented, i.e., at least one category is minority compared to other categories. The problem leads to the fact that machine learning based traffic classifier may achieve low accuracy for the minority category. Erman et al.[20]first focused on class imbalance problem in traffic classification and demonstrated how the imbalanced distribution of traffic data impacted on the accuracy of traffic classification.Vu et al. [21] evaluated various techniques for handling imbalanced data when machine learning approaches are applied in identifying encrypted traffic. Peng et al. [22] proposed an imbalanced data gravitation-based classification model to resolve the class imbalance problem in traffic classification. Liu et al. [23]proposed a traffic classification approach by combining the data re-sampling and ensemble learning algorithms. Our previous work [24]applied feature selection to address the class imbalance problem. He et al. [25] provided a critical review of the development of research in learning from imbalanced data. Wang et al.[26] performed a systematic study of online class imbalance learning.

A recent research [27] proposed a modular machine learning architecture for building the flow-level traffic classification system that classifies network traffic with two steps. Both their traffic classification system and our approach apply binary classifier for a specific application, however, the main difference from their work is that we build an optimal cascade of those binary classifiers. Moreover, in the process of training binary classifiers, we apply SMOTE algorithm [28] for solving the class imbalance problem in traffic classification.

III. AN ACCURATE AND EXTENSIBLE TRAFFIC CLASSIFICATION APPROACH

In this section, we first introduce our traffic classification system model, and then detail the training process of the cascaded traffic classifier. At last, we present the classification process of the classifier.

3.1. Traffic classification system model

The traffic classification system model is shown in figure 1. The whole system is divided into three parts: the preprocess part, the discriminator extraction part and the classification part.

Fig. 1. traffic classification system model.

Fig. 2. Information gain between the i-th packet size and application classes.

In the preprocessing, the system is developed withlibnidslibrary for tracking traffic flows and discarding the checksum error packets. A flow is described with the 5-tuples:source IP address, source port number, destination IP address, destination port number and TCP protocol. We limit our study to TCP traffic that occupies more than 90% of the bytes in our traces. To classify traffic flows on the fly, we consider the first packet sizes in a TCP flow as the discriminators. We apply information gain measureIG(X;Y) between the extracted packet sizesXand the application classY, that evaluates the discriminative power that thei-thpacket size of each TCP flow provides regarding the application.IG(X;Y) is a measure of the dependence between the values ofXandY. It is a non-negative quantity and it is zero only whenXandYare independent.Figure 2 shows the information gain between thei-thpacket size and the application classes on UNIBS datasets detailed in Section 4.1.1.It is clear that the trend ofIG(Xi;Y) as function of thei-thpacket size is decreasing. Especially, the information gains provided by both the ninth and the tenth packet sizes are lower than 0.3, suggesting that those packet sizes are prone to produce noises that decrease the classification accuracy. Therefore, we extract packet sizes as the discriminators by observing the first eight packets in each TCP flow.The extracted packet sizes are organized as an eight-dimension feature vector. It is worth noting that, if the number of packets in a TCP flow is smaller than eight, we pad the corresponding feature vector with zero. The zero padding method adopted by the work [29]was validated to be efficient and effective.Moreover, to reduce calculation cost in actual traffic classification, we will further perform feature selection for our classifier. Our traffic classifier associates traffic flows with the corresponded applications by using those discriminators. It is organized in a cascade of several binary sub-classifiers. Please note that each binary sub-classifier independently identifies a specific application. The subsequent binary sub-classifier classifies the traffic flows that cannot be identified by the precedent one. We will detail how to build the binary sub-classifi-ers, and how to make an optimal cascade with those binary sub-classifiers.

3.2. Training the cascaded traffic classifier

In this section, we first illustrate the accura-cy metric that will be used in training binary sub-classifier. Then, we detail the algorithm for training the cascaded traffic classifier.

3.2.1 The accuracy metric

True Positive Rate (TPR), False Positive Rate(FPR), Area Under the roc Curve (AUC) and F-measure are always used to measure the accuracy of traffic classifier. To illustrate our algorithm more clearly, we give a brief formal description of those metrics as follows:

• TPR is the ratio of the number of True Positives (prediction and ground truth are in agreement) in the classito the number of all tests in the classi. Supposed thatTPrepresents true positives andFNrepresents false negatives, the TPR can be calculated

• FPR is the ratio of the number of False Positives (samples of another class that has been labeled as classi) in the classito the number of samples that are not attributed to the classi. Supposed thatFPrepresents false positives andTNrepresents true negatives, the FPR can be calculated by

• AUC metric shows the relationship between TPR and FPR since TPR and FPR are correlated. On imbalanced datasets, the classifier always achieves a high FPR for majority class but a low TPR for minority class. Larger AUC denotes that both TPR and FPR achieve the best point. Therefore,it is an effective metric for evaluating the accuracy of a classifier on the imbalanced dataset.

• F-measure metric is the harmonic mean of precision and recall, where it reaches its best value at 1 and worst score at 0.The method for calculating recall is the same to that for calculating TPR. Precision is calculated byTherefore, the F-measure can be defined as

3.2.2 The algorithm for training the cascaded traffic classifier

The main idea of building the cascaded classifier is to train each binary sub-classifier for identifying application specific traffic on independent balanced datasets. Afterward we evaluate the accuracy of each binary sub-classifier by using different metrics and then connect the binary sub-classifiers in descending order of those metrics. Algorithm 1 details the training process of our proposed classifier.

As shown in algorithm 1, the training process of the cascaded traffic classifier is divided into two steps. In the first step (line1-24), the algorithm builds the binary sub-classifier for each application on a preprocessing dataset where contains two classes: the specific application class and “other” class. Specially, it first decides whether the dataset is imbalanced via the value of the imbalance factorr. In the case of the imbalanced dataset, it applies SMOTE algorithm to generate artificial samples for minority classes according to the feature space similarities between minority examples. In the section 4.2.2, we will discuss how the imbalance factorrimpacts on the classification results. Then, our algorithm selects the optimal features for each application (line 10-21). Specifically, one feature is selected if it improves classification accuracy of the binary sub-classifier. To measure the accuracy of training binary sub-classifiers, we apply four metrics:TPR, FPR, AUC and F-measure. It is worth noting that different metrics have a greate impact on the results achieved by algorithm 1. This is because that the sequence of connecting binary sub-classifiers is changed when different metrics are applied. In section 4.2.1,we will discuss how the different metrics impact on the classification results and how to select the most suitable metric for maximizing classification accuracy.

Based on the selected features, the binary sub-classifier is built with C4.5 decision tree algorithm since C4.5 algorithm demonstrates good performance in classification accuracy and speed [13].

In the second step (line 25-34), the algorithm makes an optimal cascade of those binary classifiers in descending their performance metric values. The cascaded classifier canincrease the probability of correctly classifying traffic since more samples are classified in advance by the sub-classifier with a higher metric value. In other words, it can reduce the most of uncertainties in traffic classification.The proof is detailed as follows.

Algorithm 1. Training the cascaded traffic classifier.

Theorem 1.If the sum of TPRs of two random binary sub-classifiers is larger than one and the binary sub-classifiers are connected by the descending precision, the cascaded traffic classifier can achieve higher precision than any one of those binary sub-classifiers.

Proof. We prove the theorem in a two-class classification problem since a multi-category classification problem can be converted into two class classification (one-versus-all or oneversus-one).

Given that two classes -C1andC2, the number ofC1isn1and the other isn2. nrepresents the whole number of both classesC1andC2.Classifier1is used for classifyingC1with TPRP1and FPRF1andclassifier2is forC2with TPRP2and FPRF2. Please note thatP1,F1andP2,F2are respectively achieved byclassifier1andclassifier2on the same training dataset. Especially, we can guarantee thatP1+P2>1 in the process of training the binary sub-classifiers. Afterwards, ifP1>P2andF1

The negative proposition of theorem 1 is that the overall classification precisions can be improved ifclassifier2classifies traffic flows in front ofclassifier1. The number of classC2identified byclassifier2isn2*P2+n1*F2. The number of the rest samples forclassifier1isn2*(1-P2)+n1*(1-F2). And hence, the number of classC1identified byclassifier1isn1*(1-F2)*P1+n2*(1-P2)*F1. Clearly, the number of misclassified samples here isn2*F1-n1*F2*P1-n2*F1*P2. According to the negative proposition, we can get

Due to SMOTE scheme applied in the algorithm 1, the following hypothesis is set up.

According to the equations (1) and (2), we can get

According to the inequality F1 < F2 and the equality (3), we can conclude

However, the conclusion is contradictory to the conditionP1+P2> 1. Therefore, the negative proposition is incorrect. That is to say, the cascaded traffic classifier can improve classification precision on condition that the binary sub-classifiers are connected by the descending precision, which completes the proof.

The computational complexity of algorithm 1 is affected by both the executive time of SMOTE algorithm and the training time of C4.5 decision tree. On the other hand, algorithm 1 spends more time in training decision tree than executing SMOTE algorithm. This is because the time complexity of C4.5 decision tree is related to the whole number of samples but that of SMOTE algorithm is only affected by the number of minority samples. The time complexity from line 10 to line 21 in algorithm 1 isO(N2*S*log S), whereSis the whole number of training samples. Therefore, the whole time complexity of algorithm 1 isO(M*N2*S*log S).

3.3 Classification process

The cascaded binary sub-classifiers perform traffic classification one by one. In the beginning, the flow-level features are extracted for the first binary sub-classifier. If the first binary sub-classifier can decide the application class of the identified flow, the classification process stops. Otherwise, the flow is handled further by the second binary sub-classifier. Attentively, it is necessary to derive new flow-level features for the second binary sub-classifier.The process is looped until the end of the classification for the final binary sub-classifier.

3.4 Extending the cascaded classifier

Our cascaded classifier can be extended for identifying new applications. The process for extending the classifier is shown in algorithm 2. Supposed that the new application isX, the training datasetDatais composed of both the samples labeled withXand those labeled with“other”. Firstly, the binary sub-classifier for the new applicationXis trained on the datasetData. The performance metric value for identifying the new application is achieved during the training phase. The new trained binary sub-classifier is inserted into the cascaded classifier according to its metric value.

IV. PERFORMANCE EVALUATION

4.1. Data sets

4.1.1. UNIBS datasets

To evaluate the work presented in this paper,we have extracted packet sizes as flow-level features from the UNIBS traces. The ground truth for the UNIBS traces is established by the gt client daemon [30], located at the University of Brescia (UNIBS) in Italy in September and October 2009. These traces were named as unibs20090930, unibs20091001 and unibs20091002 respectively. We focus on the identification of the applications ssl and Skype, since both ssl and Skype apply encryption algorithms in communication. We will evaluate the performance of our proposed classifier for classifying encrypted applications. The number of application flows is listedin table 1. It is worth noting that the number of http flows outnumbers the others causing the class imbalance problem. We will validate that the cascaded classifier can deal with the class imbalance problem.

Algorithm 2. An extensible algorithm.

4.1.2 MAWI datasets

The MAWI traffic repository archives [31]traffic collected from WIDE backbone networks. The WIDE network is a Japanese academic network connecting universities and research institutes. The MAWI repository has been providing anonymized traces at the transit of WIDE to the upstream ISP.Our main datasets are daily packet traces captured at Samplepoint-F from 2016/10/01 to 2016/10/02. These traces are named as Mawi161 and Mawi162 respectively. The traces have no reference to payload, due to the privacy related issues. In this case, we can only apply TCP server port to derive ground truth information. Each flow is associated to protocol identified by the server port. In Table 2,we report the list of TCP server ports with the number of flows of each class. The TCP server port is a relatively reliable source of ground truth to identify the usual protocols. We use MAWI datasets to validate that our algorithms can be applied in recent traffic classification on the backbone link.

Table I. The number of application flows.

Table II. The number of application flows on the MAWI datasets.

4.2 Experimental results

In this section, wefirst perform the design of factorial experiments on UNIBS datasets to analyze how the two factors: evaluation metrics of binary sub-classifiers and the imbalance threshold impact on the performance of our cascaded classifier. Specifically, we analyze the impacts of different evaluation metrics when not using SMOTE scheme. Once the optimal evaluation metric for binary sub-classifiers is determined, we further analyze the impacts of imbalance thresholds. Then, we analyze the key discriminators for the applications. Lastly, we compare our cascaded classifier with classical C4.5 decision tree algorithm and Bagging algorithm on both UNIBS datasets and MAWI datasets.

4.2.1 The impact of different evaluation metrics of binary sub-classifiers

In the process of training our cascaded classifier, different performance metrics for building binary sub-classifiers have different impacts on the classification accuracy. This is because different metrics arrange different sequences of connecting sub-classifiers. We perform the experiments with four metrics: FPR, F-Measure, AUC and TPR. The classification accuracies achieved with those metrics are shown in figure 3. The horizontal axis represents the experiment scenarios. The first part of each coordinate on the horizontal axis represents the training dataset and the last part of that represents the testing dataset. For example,‘30_1001’ means an experiment process,where unibs20090930 is used for training and unibs20091001 is for testing. It is clear that the classification accuracy achieved with F-Measure metric is a little higher in the experiments ‘30_1001’, ‘30_1002’, ‘1001_1002’and ‘1002_1001’. However, the classification accuracy achieved with F-Measure metric is the lowest in the experiments ‘1001_30’ and‘1002_30’. This is because in that case, most of the bittorrent samples are misclassified as http or ssl. Specifically, http and ssl flows are classified before bittorrent since the sub-classi-fiers for http and ssl achieve higher F-Measure values in the training datasets. On the other hand, the classification scheme achieved with FPR metric performs better in the experiments‘1001_30’ and ‘1002_30’. In that case, bittorrent and Skype flows are classified before the rest two applications since the binary sub-classifiers for bittorrent and Skype achieve lower FPRs in the training datasets. Thus, most of both bittorrent and Skype samples are classified accurately, which makes the TPRs for both bittorrent and Skype applications higher and the FPRs for both http and ssl applications lower.

In summary, as shown in table 1 and figure 3, when the number of training samples is enough for describing the behavior of each application, F-Measure metric is suitable for training binary sub-classifiers. If the number of one application changes significantly, such as the number of bittorrent samples in the datasets unibs20090901 and unibs20090930,FPR is more suitable for training binary classifiers.

4.2.2 The impact of the imbalance threshold

The imbalance threshold divides a training dataset into two parts: minority and majority.The algorithm 1 applies the SMOTE scheme in creating new samples for the applications in the minority part. To illustrate how to determine the imbalance thresholdTin the algorithm 1, we try to perform experiments with three thresholds on each training dataset.Each threshold makes a new application added into the minority part. For example, when the threshold is set to 0.1 in the training dataset unibs20090930, Skype is regarded as the minority. When the threshold is increased to 0.2 in the dataset unibs20090930, both Skype and ssl are considered as the minority. For the threshold 0.3, the applications except http are considered as the minority. Each dataset is used for training in turn. The impacts of the imbalance threshold on the classification accuracies are respectively demonstrated in thefigure 4,figure 5 andfigure 6.

As shown in figure 4, the classification accuracy is the highest when the imbalance threshold is set to 0.1, suggesting that only Skype application is regarded as the minority.On the other hand, when the threshold is increased to 0.2 or 0.4, SMOTE algorithm generates noises decreasing the accuracy.

As shown in figure 5, when unibs20091001 is used for training and unibs20091002 is for testing, the impact of imbalance threshold on the accuracy is not significant. In other words,the distributions of bittorrent, Skype and ssl in the unibs20091001 are similar to those in the unibs20091002. On the other hand, in the experiment scenario 1001_0930, the accuracy achieved with threshold 0.04 is the highest,suggesting that both bittorrent and Skype are considered as the minority. Thus, it is necessary for SMOTE to create new samples for the application whose number of samples in the training dataset is much smaller than in the testing dataset.

Fig. 3. Classification accuracies achieved with different metrics.

Fig. 4. The impact of the threshold when the unibs20090930 is used for training.

Fig. 5. The impact of the threshold when the unibs20091001 is used for training.

Fig. 6. The impact of the threshold when the unibs20091002 is used for training.

As shown in figure 6, it is clear that the impact of imbalance threshold is not significant in the experiment scenario 1002_1001. For the experiment scenario 1002_30, the accuracy achieved with the threshold 0.03 is the highest, suggesting that bittorrent application is the minority.

In summary, the determination of the threshold is related to two aspects, including the ratio of application samples in the training dataset and the dynamic change of the distribution of application classes. Specifically,the application with the smallest number of samples in the training dataset should be considered as the minority. The application whose number of flows is smaller in the training dataset than in the testing dataset is also regarded as the minority.

4.2.3 Discriminators for different applications

One advantage of our approach lies in the ability that the cascaded classifier can extract the key discriminators for different applications.In different experiment scenario, the extracted discriminators are different as well. To illustrate the impacts of different discriminators on classification results, we take the scenario 1002_30 for example. The extracted discriminators are listed in table 3. Due to the limited space, we only list the discriminator number.For example, the discriminator number 1 denotes the first packet size in a TCP flow and by analogy, the discriminator number 2 denotes the second packet size. Clearly, the second packet size is not used for identifying Skype but used for identifying the other applications.Comparing figure 7 and figure 8, we can see that the second packet size makes the distribution of Skype samples disperse, reducing the precision for Skype.

4.2.4 comparison with both classical C4.5 and Bagging

In this section, we compare our cascaded classifier with two classical classifiers: C4.5 decision tree and Bagging, in terms of both F-Measure and AUC metrics. Bagging is a kind of ensemble learning method. It is composed of a series of base classifiers and performs traffic classification based on voting of those base classifiers. Due to our previous work [32], we demonstrated that the based classifiers trained with C4.5 decision tree can achieve satisfied classification results. Then, the base classifiers in Bagging are trained with C4.5 decision tree.We will show that compared with both C4.5 decision tree and Bagging, our proposed cascaded classifier can further improve classification accuracy.

We compare the cascaded classifier with classical C4.5 decision tree and Bagging algorithm on both UNIBS datasets and MAWI datasets. On UNIBS datasets, we train theclassifier using one dataset and test it against the remaining two datasets. On MAWI datasets, we use one dataset for training the classifier and use the other dataset for testing. This process cycle of training with one dataset and testing against the other datasets is repeated once for each data set. As shown in Figs. 9,10, 11 and 12, both F-Measure and AUC metrics for each application achieved with our cascaded classifier are much higher. It demonstrates that the cascaded classifier can further improve the classification precision for each application. Specifically, Due to the discriminator bias problem, it is difficult for traditional C4.5 algorithm to achieve the optimal classification result. For example, on UNIBS datasets, the third packet size is able to increase the F-Measure of bit torrent by 2.7%, but to decrease the F-Measure of Skype by 0.2%.The Bagging algorithm faces the discriminator bias problem as well since the base classifiers in Bagging are trained with C4.5 decision tree.The cascaded classifier is able to avoid the discriminator bias issue by building a series of binary sub-classifiers trained in isolation for each application. The sub-classifiers classify traffic flows with their own discriminators.Furthermore, as shown in figure 11 and sfigure 12, the AUC metrics achieved with the cascaded classifier are much higher, demonstrating that the cascaded classifier can overcome class imbalance problem. In summary, the cascaded classifier outperforms both traditional C4.5 decision tree and Bagging. Furthermore, the experimental results on MAWI datasets show that the cascaded classifier can be applied in traffic classification on backbone links.

Table III. The extracted discriminators in the scenario 1002_30.

Fig. 7. The distribution of thefirst packet size in the dataset unibs20091002.

Fig. 8. The distribution of thefirst two packet sizes in the dataset unibs20091002.

Fig. 9. The comparison of F-Measures achieved by the cascaded classifier, C4.5 and Bagging on UNIBS datasets.

Fig. 10. The comparison of F-Measures achieved by the cascaded classifier, C4.5 and Bagging on MAWI datasets.

Fig. 11. The comparison of AUC metrics achieved respectively by the cascaded classifier, C4.5 and Bagging on UNIBS datasets.

4.2.5 The computation cost

In order to experimentally assess the computational performance of the cascaded classifier,in Table 4 we show the mean training and test time after running 50 times the different algorithms on all datasets. In order for this to be a fair comparison, we have performed this evaluation using the same computer (Intel Pentium CPU 3.00GHZ with 4GB RAM). Observe that the training time and the test time of the cascaded classifier is higher than C4.5 decision tree, but lower than Bagging. In other words,our method stands in the middle with moderate training and test times.

V. CONCLUSION AND FUTURE WORK

In this article, an accurate and extensible cascaded traffic classifier is proposed. It is built based on a cascade of sub-classifiers. To resolve the discriminator bias problem, each sub-classifier is trained in isolation for identifying a specific classifier. Especially, our proposed cascaded classifier applies SMOTE algorithm to solve the class imbalance problem in traffic classification. In the experiments, we illustrate how to decide the imbalance factorrand discuss the impacts of different evaluation metrics of binary sub-classifiers. Our preliminary experiment demonstrates that the accuracy of our cascaded classifier is much higher than accuracies of both traditional C4.5 and Bagging algorithms.

The features employed for this study only include packet sizes. Due to the complexity of Internet traffic, it is necessary to extract more flow-level statistical features to improve classification accuracy. In addition, we shall further apply parallelization methods for accelerating the performance of our cascaded classifier.

Fig. 12. The comparison of AUC metrics achieved respectively by the cascaded classifier, C4.5 and Bagging on MAWI datasets.

Table IV. Comparison of the training time and test time.

ACKNOWLEDGMENT

This work was supported by the National Natural Science Foundation of China under Grant No.61402485 and National Natural Science Foundation of China under Grant No.61303061, and supported by the Open fund from HPCL No. 201513-01.

[1] A. W. Moore, D. Zuev, M. Crogan, “Discriminators for use in flow-based classification,”Technical Report, Queen Mary University of London, 2005.

[2] A.W. Moore, D. Zuev, “Internet traffic classification using Bayesian analysis techniques,” InProc. of ACM SIGMETRICS’05,2005, pp. 50-60.

[3] Y. Lim, H. Kim, J. Jeong, C. Kim, T. Kwon and Y.Choi, “Internet Traffic Classification Demystified:On the Sources of the Discriminative power,” InProc. of the 6th International Conference,New York, 2010, pp. 9:1-9:12.

[4] J. Zhang, Y. Xiang, Y. Wang, W. Zhou, Y. Xiang, Y.Guan, “Network traffic classification using correlation information,”IEEE Trans. Parallel Distrib.Syst,vol. 24, no. 1, 2013.

[5] J. Zhang , X. Chen, Y. Xiang, W. Zhou, J. Wu, “Robust network traffic classification,”IEEE/ACM Trans. Netw, vol. 23, no. 4, 2015, pp. 1257–1270.

[6] R. Raveendran, R. R Menon, “A Novel aggregated statistical feature based accurate classification for Internet traffic,” InProc. of Data Mining and Advanced Computing (SAPIENCE),Ernakulam, India, 2016.

[7] F. Palmieri, U. Fiore, “A nonlinear, recurrence-based approach to traffic classification,”Computer networks, vol. 53, 2009, pp:761-773.

[8] F. Palmieri, U. Fiore, A. Castiglione, A. Santis, “On the detection of card-sharing traffic through wavelet analysis and support vector machines,”Applied Soft Computing, vol. 13, 2013, pp. 615-627.

[9] A. M. Karimi, Q. Niyaz, W. Sun, A. Y. Javaid, V.K. Devabhaktuni, “ Distributed network traffic feature extraction for a real-time IDS,” InProc.of electro information technology.Grand Forks,ND, USA, 2016.

[10] L. Bernaille, R. Teixeira, I. Akodkenou, A. Soule,K. Salamatian, “Traffic classification on the fly,”ACM SIGCOMM Computer Communication Review, vol. 36, 2006, pp. 23-26.

[11] L. Bernaille, R. Teixeira, K. Salamatian, “Early Application Identification,”CONEXT’ 06, Portugal,2006.

[12] A. Este, F. Gringoli, L. Salgarelli, “On the Stability of the Information Carried by Traffic Flow Features at the Packet Level,”ACM SIGCOMM Computer Communication Review, vol.39, 2009,pp.13-18.

[13] W. Li, M. Canini, A.W. Moore, “Efficient application identification and the temporal and spatial stability of classification schema,”Computer Networks, vol. 53, 2009, pp. 790-809.

[14] C. Lu, C. Huang, Y. Lin, Y. Lai, “High performance traffic classification based on message size sequence and distribution,”Journal of Networkand Computer Applications,vol. 76, 2016, pp.60-74.

[15] L. Peng, H. Zhang, B. Yang, Y. Chen, X. Zhou,“Early stage Internet traffic identification using data gravitation based classification,”IEEE 14th Intl Conf on Dependable, Autonomic and Secure Computing (DASC), Auckland, New Zealand,2016.

[16] L. Grimaudo, M. Mellia, E. Baralis, “Hierarchical Learning for Fine Grained Internet Traffic Classification,” InProc. Of the 8th International Conference on Wireless Communications and Mobile Computing,Limassol, 2012.

[17] M. Shafiq, X. Yu, A.Laghari, “WeChat Text Messages Service Flow Traffic Classification Using Machine Learning Technique,” The 6th International Conference on IT Convergence and Security (ICITCS). Prague, Czech Republic, 2016.

[18] R. Alshammari, A.N. zincir-Heywood, “Identification of VoIP encrypted traffic using a machine learning approach,”Computer and Information Sciences, vol. 27, no. 1, 2015, pp. 77-92.

[19] J. Muehlstein, Y. Zion, M. Bahumi, I. Kirshenboim, R. Dubin, A. Dvir, O. Pele, “Analyzing HTTPs Encrypted Traffic to Identifiy User Operating System,”Browser and Application, eprint arX-iv:1603.04865, 2016.

[20] J. Erman, A. Mahanti, M. Arlitt, “Byte me: a case for byte accuracy in traffic classification,” InProc. of the 3rd Annual ACM Workshop on Mining Network Data,2007, pp. 35-38.

[21] L. Vu, D. Tra, Q.Nguyen, “Learning from Imbalanced data for encrypted traffic identification problem,” InProc. Of the Seventh Symposium on Information and Communication Technology,Ho Chi Minh City, Viet Nam, 2016, pp. 147-152.

[22] L. Peng, H. Zhang, Y. Chen, B. Yang, “Imbalanced traffic identification using an imbalanced data gravitation-based classification model,”Computer Communications, 2017, pp. 177-189.

[23] Z. Liu, R. Wang, “SmoteAdaNL: a learning method for network traffic classification,”Journal of Ambient Intelligence and Humanized Computing,vol. 7, 2016, pp. 121-130.

[24] H. Zhang, G. Lu, M.T. Qassrawi, Y. Zhang, X Yu,“Feature Selection for Optimizing Traffic Classification.Computer Communications,” vol. 35,2012, pp.1457-1471.

[25] H. He, E.A. Garcia, “Learning from Imbalanced Data,”IEEE transactions on knowledge and data engineering,vol. 21, 2009, pp. 1263-1284.

[26] S. Wang, L. L. Minku, X. Yao, “A systematic study of online class imbalance with concept,”Computing Research Repository.abs/1703.06683,2017, http://arxiv.org/abs/1703.06683.

[27] Y. Jin, Z. Zhang, “A Modular Machine Learning System for Flow-Level Traffic Classification in Large Networks,”ACM Transactions on Knowledge Discovery from Data, vol. 6, 2012, pp. 4:1-4:34.

[28] N.V. Chawla, K.W. Bowyer, L.O. Hall and W.P.Kegelmeyer, “SMOTE: Synthetic Minority Over_sampling Technique,”Journal of Artificial Intelligence Research,vol. 16, 2002, pp. 321-357.

[29] G. D. Gil, A. H. Lashkari, M. S. I. Mamun and A.A.Ghorbani, “Characterization of encrypted and VPN traffic using time-related features,”The International Conference on Information Systems Security and Privacy, Italy, 2016.

[30] F Gringoli，L Salgarelli，M Dusi，N Cascarano，F Risso, “GT: picking up the truth from the ground for internet traffic classification,”ACM Sigcomm Computer Communication Review, vol.39, no. 5, 2009, pp. 12-18.

[31] MAWI traces, http://mawi.wide.ad.jp/mawi/samplepoint-F/2016/.

[32] H. Zhang, Gang Lu, “Machine Learning Algorithms for Classifying the Imbalanced Protocol Flows: Evaluation and Comparison,”Journal of Software,vol. 23,no. 6, 2012, pp.1500-1516.