Optimised Multi-stage TCP Traffic Classifier Based on Packet Size Distributions

Since it is believed that the distribution patterns of different applications are distinct over a period of time, many researchers have proposed that packet size distributions can be used for classifying network traffic flows. However, Nagle´s algorithm coalesces TCP packets, transferring as many bytes as possible per packet. This masks the characteristics of application behaviour, making the identification of traffic more difficult. Packet length distributions also deteriorated due to an overwhelming number of maximum transmission unit (MTU) packets. This paper presents an approach for optimising the classification, using multiple classifiers to handle classes separately. Meanwhile, the size of the classifying window is also discussed in order to find the best detection periods in the time domain. The experimental results confirmed that, the proposed system has higher accuracy and enables earlier classification of TCP traffic.