Support Vector Machines for TCP traffic classification

To link to full-text access for this article, visit this link: http://dx.doi.org/10.1016/j.comnet.2009.05.003 Byline: Alice Este, Francesco Gringoli, Luca Salgarelli Keywords: Traffic classification; Machine Learning Abstract: Support Vector Machines (SVM) represent one of the most promising Machine Learning (ML) tools that can be applied to the problem of traffic classification in IP networks. In the case of SVMs, there are still open questions that need to be addressed before they can be generally applied to traffic classifiers. Having being designed essentially as techniques for binary classification, their generalization to multi-class problems is still under research. Furthermore, their performance is highly susceptible to the correct optimization of their working parameters. In this paper we describe an approach to traffic classification based on SVM. We apply one of the approaches to solving multi-class problems with SVMs to the task of statistical traffic classification, and describe a simple optimization algorithm that allows the classifier to perform correctly with as little training as a few hundred samples. The accuracy of the proposed classifier is then evaluated over three sets of traffic traces, coming from different topological points in the Internet. Although the results are relatively preliminary, they confirm that SVM-based classifiers can be very effective at discriminating traffic generated by different applications, even with reduced training set sizes. Author Affiliation: DEA, Universita degli Studi di Brescia, via Branze, 38, 25123 Brescia, Italy Article History: Received 29 July 2008; Accepted 8 May 2009 Article Note: (footnote) [star] This work was supported in part by a grant from the Italian Ministry for University and Research (MIUR), under the PRIN project RECIPE.