Imbalanced Internet Traffic Classification Using Ensemble Framework

Abstract

Machine learning (ML)-based traffic classification has been gaining increasing importance due to the declining port-based and payload-based approaches. However, the packet-level method is the most common measure used in the previous works, which requires additional hardware device to manage and monitor, increasing cost as well as extra works of the network personnel. In this paper, we propose a methodology to build an efficient classifier from NetFlow which is the widely applied monitoring solution among network operators in the form of flow-level. First, we analyze the per-application performance through the C4.5 decision tree with the features derived from the NetFlow records. The result shows that the accuracy obtained is as good as the packet-level method. We further propose the ensemble feature selection (FS) method to improve the classification accuracy and to reduce the computational complexity. Lastly, we present the clustering-based under-sampling combining with synthetic minority over-sampling technique (SMOTE) approach to solving the problem of the concept drift and the imbalanced dataset, and we extract insights and recommendation for practical application. With the combination of proposed methods, the experiment result reports high F-measure over two traces containing the wide range of applications with low computational complexity.