A Novel Online Traffic Classification Method Based on Few Packets

Accurate online network traffic classification plays an important role in many areas such as traffic engineering, QoS and intrusion detection. In this paper, four traffic classification methods are compared, which are classification based on entire packets of a flow (CEP), classification based on the first few packets of a flow (CFFP), classification based on arbitrary conjoint few packets (CACFP) and classification based on arbitrary disjunctive few packets of a flow (CADFP). Experiment results demonstrate that, without contribution of port feature, CACFP and CADFP achieved almost the same high classification accuracies in comparing with CEP and CFFP. The most important contribution of our method is that it significantly enhanced the robustness of online traffic classification. It can efficiently adapt to half-baked flows, which take over a certain proportion in real network condition. The method makes it possible for deploying practical online traffic classification system.