Training traffic classifiers with arbitrary packet sets

Many existing machine learning based traffic classifiers require the first five packets in traffic flows to perform traffic classification. In this work, we investigate the flexibility of using arbitrary sets of packets to train traffic classifiers. Such classifiers could be used as auxiliary classifiers that would function in cases where some packets in flows are unavailable, possibly due to packet losses/retransmissions. Moreover, they could be used to mitigate the issue that payload mutation techniques are used by some malicious applications to evade classification. Experimental results show that with using some packet sets, our classifier produces comparable accuracy to the classifier using the first five packets in flows.