Statistical traffic classification by boosting support vector machines

Abstract

In recent years, traffic classification based on the statistical properties of flows has become an important topic. In this paper we statistically analyze the data length of the first few segments exchanged by a transport flow. This traffic classification method may be useful for early traffic identification in real time, since it takes into account only the beginning of the flow and therefore it can be used to trigger on-line actions. This work proposes the use of a supervised machine learning method for traffic identification based on Support Vector Machines (SVM). We compare the SVM classification accuracy with a more classical centroid based approach, obtaining good results. We also propose an improvement of the classification accuracy preformed by one single SVM model, introducing a weighted voting scheme of the verdicts of a sequence of SVM models. This sequence is generated by means of the boosting technique and the proposed method improves the classification accuracy of poorly classified classes without noticeable detriment of the other traffic classes. This work analyzes the behavior of both TCP and UDP transport protocols.