Efficient and robust feature extraction and selection for traffic classification

Given the limitations of traditional classification methods based on port number and payload inspection, a large number of studies have focused on developing classification approaches that use Transport Layer Statistics (TLS) features and Machine Learning (ML) techniques. However, classifying Internet traffic data using these approaches is still a difficult task because (1) TLS features are not very robust for traffic classification because they cannot capture the complex non-linear characteristics of Internet traffic, and (2) the existing Feature Selection (FS) techniques cannot reliably provide optimal and stable features for ML algorithms. With the aim of addressing these problems, this paper presents a novel feature extraction and selection approach. First, multifractal features are extracted from traffic flows using a Wavelet Leaders Multifractal Formalism(WLMF) to depict the traffic flows; next, a Principal Component Analysis (PCA)-based FS method is applied on these multifractal features to remove the irrelevant and redundant features. Based on real traffic traces, the experimental results demonstrate significant improvement in accuracy of Support Vector Machines (SVMs) comparing to the TLS features studied in existing ML-based approaches. Furthermore, the proposed approach is suitable for real time traffic classification because of the ability of classifying traffic at the early stage of traffic transmission.

[1]  W. Willinger,et al.  Toward an Improved Understanding of Network Traffic Dynamics , 2000 .

[2]  Huan Liu,et al.  Feature Selection for High-Dimensional Data: A Fast Correlation-Based Filter Solution , 2003, ICML.

[3]  Jan Beran,et al.  Statistics for long-memory processes , 1994 .

[4]  Mark A. Hall,et al.  Correlation-based Feature Selection for Discrete and Numeric Class Machine Learning , 1999, ICML.

[5]  Patrice Abry,et al.  Wavelet leaders and bootstrap for multifractal analysis of images , 2009, Signal Process..

[6]  Zahir Tari,et al.  An optimal and stable feature selection approach for traffic classification based on multi-criterion fusion , 2014, Future Gener. Comput. Syst..

[7]  Michalis Faloutsos,et al.  BLINC: multilevel traffic classification in the dark , 2005, SIGCOMM '05.

[8]  David G. Stork,et al.  Pattern Classification , 1973 .

[9]  Huan Liu,et al.  A selective sampling approach to active feature selection , 2004, Artif. Intell..

[10]  Xiaohong Guan,et al.  An SVM-based machine learning method for accurate internet traffic classification , 2010, Inf. Syst. Frontiers.

[11]  Juraj Gazda,et al.  An experimental comparison of feature selection methods on two-class biomedical datasets , 2015, Comput. Biol. Medicine.

[12]  S. Mallat A wavelet tour of signal processing , 1998 .

[13]  Andrew W. Moore,et al.  Internet traffic classification using bayesian analysis techniques , 2005, SIGMETRICS '05.

[14]  Ece Guran Schmidt,et al.  An intrusion detection based approach for the scalable detection of P2P traffic in the national academic network backbone , 2006, 2006 International Symposium on Computer Networks.

[15]  Chao-Ton Su,et al.  An Extended Chi2 Algorithm for Discretization of Real Value Attributes , 2005, IEEE Trans. Knowl. Data Eng..

[16]  Han-Xiong Li,et al.  PCA based sequential feature space learning for gene selection , 2010, 2010 International Conference on Machine Learning and Cybernetics.

[17]  P. Tse,et al.  Singularity analysis of the vibration signals by means of wavelet modulus maximal method , 2007 .

[18]  Patrick Haffner,et al.  ACAS: automated construction of application signatures , 2005, MineNet '05.

[19]  Hai Wang,et al.  A novel traffic identification approach based on multifractal analysis and combined neural network , 2014, Ann. des Télécommunications.

[20]  Matthew Roughan,et al.  Class-of-service mapping for QoS: a statistical signature-based approach to IP traffic classification , 2004, IMC '04.

[21]  P. Cochat,et al.  Et al , 2008, Archives de pediatrie : organe officiel de la Societe francaise de pediatrie.

[22]  Anja Feldmann,et al.  Scaling Analysis of Conservative Cascades, with Applications to Network Traffic , 1999, IEEE Trans. Inf. Theory.

[23]  Andrew W. Moore,et al.  Bayesian Neural Networks for Internet Traffic Classification , 2007, IEEE Transactions on Neural Networks.

[24]  Sebastian Zander,et al.  Evaluating machine learning algorithms for automated network application identification , 2006 .

[25]  Marco Canini,et al.  Efficient application identification and the temporal and spatial stability of classification schema , 2009, Comput. Networks.

[26]  Richard G. Baraniuk,et al.  A Multifractal Wavelet Model with Application to Network Traffic , 1999, IEEE Trans. Inf. Theory.

[27]  P. Abry,et al.  Bootstrap for Empirical Multifractal Analysis , 2007, IEEE Signal Processing Magazine.

[28]  Anja Feldmann,et al.  Data networks as cascades: investigating the multifractal nature of Internet WAN traffic , 1998, SIGCOMM '98.

[29]  S. Mitra,et al.  Bioinformatics with soft computing , 2006, IEEE Transactions on Systems, Man, and Cybernetics, Part C (Applications and Reviews).

[30]  Anja Feldmann,et al.  The changing nature of network traffic: scaling phenomena , 1998, CCRV.

[31]  H. Kaiser A NOTE ON GUTTMAN'S LOWER BOUND FOR THE NUMBER OF COMMON FACTORS1 , 1961 .

[32]  Salvatore J. Stolfo,et al.  Anomalous Payload-Based Network Intrusion Detection , 2004, RAID.

[33]  Jensen,et al.  Direct determination of the f( alpha ) singularity spectrum and its application to fully developed turbulence. , 1989, Physical review. A, General physics.

[34]  David Moore,et al.  The CoralReef Software Suite as a Tool for System and Network Administrators , 2001, LISA.

[35]  Michalis Faloutsos,et al.  Transport layer identification of P2P traffic , 2004, IMC '04.

[36]  Ece Guran Schmidt,et al.  Machine learning algorithms for accurate flow-based network traffic classification: Evaluation and comparison , 2010, Perform. Evaluation.

[37]  Chita R. Das,et al.  Memory-efficient content filtering hardware for high-speed intrusion detection systems , 2007, SAC '07.

[38]  Grenville J. Armitage,et al.  A survey of techniques for internet traffic classification using machine learning , 2008, IEEE Communications Surveys & Tutorials.

[39]  E.G. Schmidt,et al.  An accurate evaluation of machine learning algorithms for flow-based P2P traffic detection , 2007, 2007 22nd international symposium on computer and information sciences.

[40]  A. Arneodo,et al.  Wavelet transform of multifractals. , 1988, Physical review letters.

[41]  Walter Willinger,et al.  Is Network Traffic Self-Similar or Multifractal? , 1997 .

[42]  Konstantina Papagiannaki,et al.  Toward the Accurate Identification of Network Applications , 2005, PAM.

[43]  Patrice Abry,et al.  Wavelet Leader multifractal analysis for texture classification , 2009, 2009 16th IEEE International Conference on Image Processing (ICIP).

[44]  Luca Salgarelli,et al.  A statistical approach to IP-level classification of network traffic , 2006, 2006 IEEE International Conference on Communications.

[45]  Sebastian Zander,et al.  A preliminary performance comparison of five machine learning algorithms for practical IP traffic flow classification , 2006, CCRV.

[46]  Chih-Jen Lin,et al.  A comparison of methods for multiclass support vector machines , 2002, IEEE Trans. Neural Networks.

[47]  Oliver Spatscheck,et al.  Accurate, scalable in-network identification of p2p traffic using application signatures , 2004, WWW '04.

[48]  Stéphane Jaffard,et al.  Multifractal formalism for functions part I: results valid for all functions , 1997 .

[49]  Michalis Faloutsos,et al.  Internet traffic classification demystified: myths, caveats, and the best practices , 2008, CoNEXT '08.

[50]  Sichun Wang,et al.  A PCA Based Unsupervised Feature Selection Algorithm , 2008, 2008 Second International Conference on Genetic and Evolutionary Computing.

[51]  Nacim Betrouni,et al.  Fractal and multifractal analysis: A review , 2009, Medical Image Anal..

[52]  Sebastian Zander,et al.  Automated traffic classification and application identification using machine learning , 2005, The IEEE Conference on Local Computer Networks 30th Anniversary (LCN'05)l.

[53]  Stéphane Jaffard,et al.  Multifractal formalism for functions part II: self-similar functions , 1997 .

[54]  Gene H. Golub,et al.  Singular value decomposition and least squares solutions , 1970, Milestones in Matrix Computation.

[55]  Gang Lu,et al.  Feature selection for optimizing traffic classification , 2012, Comput. Commun..

[56]  R. Suganya,et al.  Data Mining Concepts and Techniques , 2010 .

[57]  Stphane Mallat,et al.  A Wavelet Tour of Signal Processing, Third Edition: The Sparse Way , 2008 .

[58]  B. Brown,et al.  Concepts and Techniques , 1983 .

[59]  Patrice Abry,et al.  Wavelet Analysis of Long-Range-Dependent Traffic , 1998, IEEE Trans. Inf. Theory.

[60]  Melanie Hilario,et al.  Stability of feature selection algorithms: a study on high-dimensional spaces , 2007, Knowledge and Information Systems.

[61]  Robert Tibshirani,et al.  The Elements of Statistical Learning: Data Mining, Inference, and Prediction, 2nd Edition , 2001, Springer Series in Statistics.

[62]  Shigeo Abe DrEng Pattern Classification , 2001, Springer London.

[63]  S. Jaffard,et al.  Methodology for multifractal analysis of heart rate variability: From LF/HF ratio to wavelet leaders , 2010, 2010 Annual International Conference of the IEEE Engineering in Medicine and Biology.

[64]  Isabelle Guyon,et al.  An Introduction to Variable and Feature Selection , 2003, J. Mach. Learn. Res..

[65]  Bernhard E. Boser,et al.  A training algorithm for optimal margin classifiers , 1992, COLT '92.

[66]  H. Kaiser The varimax criterion for analytic rotation in factor analysis , 1958 .

[67]  Anthony McGregor,et al.  Flow Clustering Using Machine Learning Techniques , 2004, PAM.

[68]  Xiaochun Yun,et al.  Optimizing Traffic Classification Using Hybrid Feature Selection , 2008, 2008 The Ninth International Conference on Web-Age Information Management.

[69]  Dong Hoon Lim,et al.  Principal Component Analysis using Singular Value Decomposition of Microarray Data , 2013 .

[70]  E. Bacry,et al.  Multifractal formalism for fractal signals: The structure-function approach versus the wavelet-transform modulus-maxima method. , 1993, Physical review. E, Statistical physics, plasmas, fluids, and related interdisciplinary topics.

[71]  Fengxi Song,et al.  Feature Selection Using Principal Component Analysis , 2010, 2010 International Conference on System Science, Engineering Design and Manufacturing Informatization.

[72]  E. Bacry,et al.  Singularity spectrum of fractal signals from wavelet analysis: Exact results , 1993 .