Machine Learning-Based Elephant Flow Classification on the First Packet

In this paper, we explore the applicability of selected machine learning models to classify incoming flows as elephants or mice on the first packet, using Internet Protocol (IP) and transport layer headers (5-tuple). We show that traditional metrics such as accuracy or F1-score are inadequate for assessing performance in traffic engineering (TE) and quality of service (QoS) applications unless compared at the same traffic coverage. Among the classifiers analyzed, Histogram-based Gradient Boosting with octets-transformed input data provides the best performance, reducing flow operations by a factor of 36.49 and the average number of flow table entries by 16.35, while covering 80% of the traffic.