The traffic classification is the foundation for many network activities, such as quality of service (QoS), security monitoring, lawful interception, and intrusion detection system (IDS). A recent statistics-based method to address the unsatisfactory results of traditional port-based and payload-based methods has attracted attention. However, the presence of non-informative attributes and noise instances degrade the performance of this method. Thus, to address this problem, in this chapter, a hybrid clustering-classification method (called CluClas) is described to improve the accuracy and efficiency of network traffic classification by selecting informative attributes and representative instances. An extensive empirical study on four traffic data sets shows the effectiveness of the CluClas method.

Chapter Contents:

• 10.1 Introduction
• 10.2 Existing solutions
• 10.3 CluClas—a hybrid clustering and classification method
• 10.3.1 Discarding irrelevant and redundant attributes
• 10.3.2 Identifying representative instances in CluClas
• 10.3.3 The CluClas learning process
• 10.3.4 Classification/Prediction process in CluClas method
• 10.4 Experimental evaluation
• 10.4.1 Experimental setting
• 10.4.2 Traffic data sets
• 10.4.3 Evaluation metrics
• 10.4.4 Results and discussion
• 10.5 Conclusion

Inspec keywords: quality of service; pattern clustering; computer network security; telecommunication traffic; statistical analysis; pattern classification

Other keywords: noninformative attributes; efficient network classification; network traffic classification; hybrid clustering-classification method; network activities; lawful interception; traffic data sets; noise instances; statistics-based method; intrusion detection system; informative attributes; CluClas method; security monitoring; traditional port-based

Subjects: Other topics in statistics; Other topics in statistics; Data security; Computer communications; Computer networks and techniques