Evaluating Application-Layer Classification Using a Machine Learning Technique over Different High Speed Networks

Abstract

Application–layer classification is needed in many monitoring applications. Classification based on machine learning offers an alternative method to methods based on port or payload based techniques. It is based on statistical features computed from network flows. Several works investigated the efficiency of machine learning techniques and found algorithms suitable for network classification. A classifier based on machine learning is built by learning from a training data set that consists of data from known application traces. In this paper, we evaluate the efficiency of application-layer classification based on C4.5~machine learning algorithm used for classification network flows from different high speed networks, such as 100~Mbit, 1~Gbit and 10~Gbit networks. We find a significant decrease in the classification efficiency when classifier built for one network is used to classify other network. We recommend to build classifier from data collected from all available networks for best results. However, if different networks are not available, good results can be obtained from data traces to the commodity Internet.