Early traffic identification using Bayesian networks

Port-based or payload-based analysis is becoming difficult for accurate traffic identification when many applications use dynamic port numbers and encryption to avoid detection. In this paper we present an approach for online traffic classification relying on the observation of the first n packets of a flow. The packet size and inter-arrival times of the individual packets, rather than the statistic features, are chosen as identification parameters. We use labeled data set as training set to construct a Naïve Bayes classifier and use the real discretized conditional probability instead of Gaussian distribution. Two real data sets collected in the campus networks are used to evaluate the proposed approach and the effectiveness is proved. The results also indicate that this approach is not sensitive to the prior probability estimation in most cases, and that packet sizes are more efficient than the inter-arrival times although both of them are important.