A survey of techniques for internet traffic classification using machine learning

• Published in: IEEE Communications surveys and tutorials Vol. 10; no. 4; pp. 56 - 76
• Main Authors: Nguyen, Thuy T.T., Armitage, Grenville
• Format: Journal Article
• Language: English
• Published: IEEE 01.01.2008
• Subjects: Flow clustering; Government; Inspection; Internet; Internet Protocol; Intrusion detection; Machine learning; Payload inspection; Payloads; Protocols; Real Time; Statistical traffic properties; TCPIP; Telecommunication traffic; Telephony; Traffic classification
• ISSN: 1553-877X
• DOI: 10.1109/SURV.2008.080406

The research community has begun looking for IP traffic classification techniques that do not rely on `well known' TCP or UDP port numbers, or interpreting the contents of packet payloads. New work is emerging on the use of statistical traffic characteristics to assist in the identification and classification process. This survey paper looks at emerging research into the application of Machine Learning (ML) techniques to IP traffic classification - an inter-disciplinary blend of IP networking and data mining techniques. We provide context and motivation for the application of ML techniques to IP traffic classification, and review 18 significant works that cover the dominant period from 2004 to early 2007. These works are categorized and reviewed according to their choice of ML strategies and primary contributions to the literature. We also discuss a number of key requirements for the employment of ML-based traffic classifiers in operational IP networks, and qualitatively critique the extent to which the reviewed works meet these requirements. Open issues and challenges in the field are also discussed.