Early Identifying Application Traffic with Application Characteristics

To more accurately extract the characteristics of application flows, this paper proposes a set of flow attributes to characterize the possible negotiation behaviors of each flow in application layer perspective. The discriminators are available in the early stage, so they are suitable to support real-time based traffic classification and engineering. The ability of flow attributes was tested with several machine learning algorithms. On the other hand, we also compare the accuracy of our method with other related works that addressed real-time traffic classification problem based on the same sample traffic. The result shows that our method outperforms other previous works in protocol level identification with more than 8%~21% accuracy improvement based on fixed-ratio sample flow sets. Furthermore, the proposed method is also suitable to identify encrypted protocols.