Traffic classification using clustering algorithms

TLDR

Network traffic classification is increasingly difficult due to dynamic ports, masquerading, and encryption, prompting a shift toward exploiting application characteristics for detection. The study aims to show that cluster analysis can identify similar traffic groups using only transport‑layer statistics. The authors evaluate K‑Means and DBSCAN, comparing them to AutoClass on empirical Internet traces. K‑Means and DBSCAN perform well and faster than AutoClass, with DBSCAN yielding better clusters despite lower accuracy.

Abstract

Classification of network traffic using port-based or payload-based analysis is becoming increasingly difficult with many peer-to-peer (P2P) applications using dynamic port numbers, masquerading techniques, and encryption to avoid detection. An alternative approach is to classify traffic by exploiting the distinctive characteristics of applications when they communicate on a network. We pursue this latter approach and demonstrate how cluster analysis can be used to effectively identify groups of traffic that are similar using only transport layer statistics. Our work considers two unsupervised clustering algorithms, namely K-Means and DBSCAN, that have previously not been used for network traffic classification. We evaluate these two algorithms and compare them to the previously used AutoClass algorithm, using empirical Internet traces. The experimental results show that both K-Means and DBSCAN work very well and much more quickly then AutoClass. Our results indicate that although DBSCAN has lower accuracy compared to K-Means and AutoClass, DBSCAN produces better clusters.