An analysis of UDP traffic classification

Accurate and timely classification of network applications is fundamental to numerous network activities. The traditional methods based on the “well-known” ports and packet payload analysis could no longer meet the need to accurately identify the IP traffic. Therefore, a promising approach using the machine learning techniques has received more and more attention. There are a lot of work about this field. However, earlier work generally believed that TCP traffic occupied the main body, and UDP traffic is negligible, and therefore ignored the study of classifying UDP traffic. However, with the increase of network bandwidth, based on real-time considerations, more and more new applications use UDP as transport layer protocol, which directly increase UDP traffic. In view of this, we mainly discuss the classification of UDP traffic. Firstly, we divided the whole UDP traffic into five categories according to theirs specific characteristic. Secondly, we use four machine learning techniques{Naive Bayes, SVMs, C4.5, K-Means} to classify the UDP traffic of these five categories. Through the comparison and analysis, we find the supervised techniques can achieve higher accuracy than the unsupervised clustering techniques. Among the above four techniques, the Naive Bayes always gets the minimum performance, while the C4.5 is always the maximum. The Simple K-Means always lies between the Naive Bayes and other supervised learning techniques, and it outperforms the Naive Bayes classifier by 17%.