Internet traffic classification demystified

TLDR

Recent research on Internet traffic classification has produced many proposed algorithms, yet no systematic comparison exists, leaving the operational community without consensus on which approach to use or how to interpret results. The study evaluates three traffic classification approaches—transport-layer ports, host behavior, and flow features—to provide a systematic comparison. The authors assess these approaches on seven geographically diverse traffic traces from Japan, Korea, and the US, and supply open-source software, classifiers, and data for replication. The analysis reveals each approach’s strengths and weaknesses, proposes mitigation methods, and offers practical recommendations for traffic classification.

Abstract

Recent research on Internet traffic classification algorithms has yield a flurry of proposed approaches for distinguishing types of traffic, but no systematic comparison of the various algorithms. This fragmented approach to traffic classification research leaves the operational community with no basis for consensus on what approach to use when, and how to interpret results. In this work we critically revisit traffic classification by conducting a thorough evaluation of three classification approaches, based on transport layer ports, host behavior, and flow features. A strength of our work is the broad range of data against which we test the three classification approaches: seven traces with payload collected in Japan, Korea, and the US. The diverse geographic locations, link characteristics and application traffic mix in these data allowed us to evaluate the approaches under a wide variety of conditions. We analyze the advantages and limitations of each approach, evaluate methods to overcome the limitations, and extract insights and recommendations for both the study and practical application of traffic classification. We make our software, classifiers, and data available for researchers interested in validating or extending this work.