Self Learning Network Traffic Classification

Network management is part of traffic engineering and security. The current solutions - Deep Packet Inspection (DPI) and statistical classification, rely on the availability of a training set. In case of these there is a cumbersome need to regularly update the signatures. Further their visibility is limited to classes the classifier has been trained for. Unsupervised algorithms have been envisioned as a an alternative to automatically identify classes of traffic. To address these issues Self Learning Network Traffic Classification is proposed. It uses unsupervised algorithms along with an adaptive seeding approach to automatically lets classes of traffic to emerge, making them identified and labelled. Unlike traditional classifiers, there is no need of a-priori knowledge of signatures nor a training set to extract the signatures. Instead, Self Learning Network Traffic Classification automatically groups flows into pure (or homogeneous) clusters using simple statistical features. This label assignment (which is still based on some manual intervention) ensures that class labels can be easily discovered. Furthermore, Self Learning Network Traffic Classification uses an iterative seeding approach which will boost its ability to cope with new protocols and applications. Unlike state-of-art classifiers, the biggest advantage of Self Learning Network Traffic Classification is its ability to discover new protocols and applications in an almost automated fashion.