Bujlow, Tomasz2; Riaz, M. Tahir4; Pedersen, Jens Myrup1
1 Department of Electronic Systems, The Faculty of Engineering and Science (ENG), Aalborg University, VBN2 Networking and Security, The Faculty of Engineering and Science (ENG), Aalborg University, VBN3 The Faculty of Engineering and Science (TECH), Aalborg University, VBN4 Center for Network Planning, The Faculty of Engineering and Science (ENG), Aalborg University, VBN
Monitoring of the network performance in high-speed Internet infrastructure is a challenging task, as the requirements for the given quality level are service-dependent. Backbone QoS monitoring and analysis in Multi-hop Networks requires therefore knowledge about types of applications forming current network traffic. To overcome the drawbacks of existing methods for traffic classification, usage of C5.0 Machine Learning Algorithm (MLA) was proposed. On the basis of statistical traffic information received from volunteers and C5.0 algorithm we constructed a boosted classifier, which was shown to have ability to distinguish between 7 different applications in test set of 76,632-1,622,710 unknown cases with average accuracy of 99.3-99.9%. This high accuracy was achieved by using high quality training data collected by our system, a unique set of parameters used for both training and classification, an algorithm for recognizing flow direction and the C5.0 itself. Classified applications include Skype, FTP, torrent, web browser traffic, web radio, interactive gaming and SSH. We performed subsequent tries using different sets of parameters and both training and classification options. This paper shows how we collected accurate traffic data, presents arguments used in classification process, introduces the C5.0 classifier and its options, and finally evaluates and compares the obtained results.
Icnc'12: 2012 International Conference on Computing, Networking and Communications (icnc): Workshop on Computing, Networking and Communications, 2012, p. 237-241