PortLoad: Taking the Best of Two Worlds in Traffic Classification

Abstract

Traffic classification approaches based on deep packet inspection (DPI) are considered very accurate, however, two major drawbacks are their invasiveness with respect to users privacy, and their significant computational cost. Both are a consequence of the amount of per-flow payload data - we refer to it as "deepness" - typically inspected by such algorithms. At the opposite side, the fastest and least data-eager traffic classification approach is based on transport-level ports, even though today it is mostly considered inaccurate. In this paper we propose a novel approach to traffic classification - named PortLoad - that takes the advantages of both worlds: the speed, simplicity and reduced invasiveness of port-based approaches, on a side, and the classification accuracy of DPI on the other one.