Iterative-tuning support vector machine for network traffic classification

Accurate and timely traffic classification is a key to providing Quality of Service (QoS), application-level visibility, and security monitoring for network operations and management. A class of traffic classification techniques have emerged that apply machine learning technology to predict the application class of a traffic flow based on the statistical properties of flow-features. In this paper, we propose a novel iterative-tuning scheme to increase the training speed of the classification algorithm using Support Vector Machine (SVM) learning. Meanwhile we derive the equations to obtain SVM parameters by conducting theoretical analysis of iterative-tuning SVM. Traffic classification is carried out using flow-level information extracted from NetFlow data. Performance evaluation demonstrates that the proposed iterative-tuning SVM exhibits a training speed that is two to ten times faster than eight other previously proposed SVM techniques found in the literature, while maintaining comparable classification accuracy as those eight SVM techniques. In the presence of millions of flows and Terabytes of data in the network, faster training speeds is essential to making SVM techniques a viable option for real-world deployment of traffic classification modules. In addition, network operators and cloud service providers can apply network traffic classification to address a range of issues including semi-real-time security monitoring and traffic engineering.