Internet traffic classification using energy time-frequency distributions

We present a fundamentally new approach to classify application flows based on the mapping of aggregate transport-layer volume information onto the Time-Frequency (TF) plane. We initially show that the volume persona (i.e. counts of packets and bytes) of traffic flows at the transport layer exhibits highly non-stationary characteristics, hence rendering many typical classification methods inapplicable. By virtue of this constraint, we present a novel application classification method based on the Cohen energy TF distributions for such highly non-stationary signals. We have used the Rényi information to measure the distinct complexity of any given application signal, and to subsequently construct a robust training model for every application protocol within our scheme. The effectiveness of our approach is demonstrated using real backbone and edge link network traces captured in US and Japan. Our results show that for the majority of applications, aggregate volume-based classification can reach up to 96% accuracy, while considering significantly less features in comparison with existing approaches.