Impact of Asymmetric Routing on Statistical Traffic Classification

Statistical traffic classification techniques are often developed under the assumption that monitoring devices can observe the two half-flows composing each traffic session. However, the practice of asymmetric routing is rapidly moving from the Internet core to its edge. Forecasts [1] predict that in a few years even the last legs of Internet connectivity will experience some form of this practice. In this paper we study the effects that asymmetric routing can have on statistical traffic classifiers. We do so by comparing the capability of unidirectional classifiers with the ones of bidirectional classifiers in extracting information from the features of half-flows. Numerical results obtained by processing three heterogeneous traffic traces not only confirm the obvious assumption that bidirectional classifiers work better than unidirectional ones, but also shed some light on a few interesting facts. First, that the improvement introduced by bidirectional classifiers is not very significant in terms of increased true positives, while it is substantial in terms of decreased false positives. Furthermore, some protocols seem to exhibit, at least in some environments, the tendency to carry more information (relevant to traffic classification) in one direction than in the other.