Internet Traffic Classification Using the Index of Variability

Internet Traffic Classification aims at the identification of the Internet application that generates a given sequence of packets. Shallow Packet Inspection (SPI) is a new family of classification techniques that only use information available in the external header of packets and the statistical characterization of the traffic process. Therefore, these techniques are applicable even to encrypted or obfuscated traffic. The packet arrival process is a particularly interesting features for traffic classification, as it is difficult to significantly modify it. This paper proposes a classification technique based on a classification feature called Index of Variability, which evaluates the traffic source burstiness over various time scales in order to discriminate among different classes of Internet applications. Experimental results show that this classification method operates effectively both on synthetic and real traffic traces. Synthetic traffic traces make it possible to estimate the classification error rate achieved by the classification algorithm. The usage of real traces allows us to compare the performance of the method to the performance obtained with Deep Packet Inspection (DPI) techniques, showing that SPI and DPI yields similar results.