Pattern Recognition Approaches for Classifying IP Flows

  • Alice Este
  • Francesco Gargiulo
  • Francesco Gringoli
  • Luca Salgarelli
  • Carlo Sansone
Part of the Lecture Notes in Computer Science book series (LNCS, volume 5342)


The assignment of an IP flow to a class, according to the application that generated it, is at the basis of any modern network management platform. However, classification techniques such as the ones based on the analysis of transport layer or application layer information are rapidly becoming ineffective. Moreover, in several network scenarios it is quite unrealistic to assume that all the classes an IP flow can belong to are a priori known. In these cases, in fact, some network protocols may be known, but novel protocols can appear so giving rise to unknown classes.

In this paper we propose to face the problem of classifying IP flows by means of different pattern recognition approaches. They have been explicitly devised in order to effectively address the problem of the unknown classes, too. An experimental evaluation of the various proposal on real traffic traces is also provided, by considering different network scenarios.


Support Vector Machine Gaussian Mixture Model Network Scenario Cost Matrix Application Protocol 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


  1. 1.
  2. 2.
    Karagiannis, T., Papagiannaki, K., Faloutsos, M.: BLINC: multilevel traffic classification in the dark. In: Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications (SIGCOMM 2005), Philadelphia, PA, USA, pp. 229–240 (August 2005)Google Scholar
  3. 3.
    Roughan, M., Sen, S., Spatscheck, O., Duffield, N.: Class–of–service mapping for QoS: a statistical signature–based approach to IP traffic classification. In: Proceedings of the 4th ACM SIGCOMM conference on Internet measurement (IMC 2004), Taormina, Sicily, Italy, pp. 135–148 (October 2004)Google Scholar
  4. 4.
    McGregor, A., Hall, M., Lorier, P., Brunskill, J.: Flow Clustering Using Machine Learning Techniques. In: Barakat, C., Pratt, I. (eds.) PAM 2004. LNCS, vol. 3015, pp. 205–214. Springer, Heidelberg (2004)CrossRefGoogle Scholar
  5. 5.
    Williams, N., Zander, S., Armitage, G.: A Preliminary Performance Comparison of Five Machine Learning Algorithms for Practical IP Traffic Flow Classification. SIGCOMM Computer Communication Review 36(5), 7–15 (2006)CrossRefGoogle Scholar
  6. 6.
    Bernaille, L., Teixeira, R., Salamatian, K.: Early Application Identification. In: Proceedings of the 2006 ACM CoNEXT conference (CoNEXT 2006), Lisboa, Portugal, pp. 1–12 (December 2006)Google Scholar
  7. 7.
    Li, R.Y.Z., Guan, X.: Accurate Classification of the Internet Traffic Based on the SVM Method. In: Proceedings of the 42th IEEE International Conference on Communications (ICC 2007), Glasgow, Scotland, pp. 1373–1378 (June 2007)Google Scholar
  8. 8.
    Tax, D.M.J., Duin, R.P.W.: Growing a multi–class classifier with a reject option. Pattern Recognition Letters 29, 1565–1570 (2008)CrossRefGoogle Scholar
  9. 9.
    Fumera, G., Roli, F., Giacinto, G.: Reject option with multiple thresholds. Pattern Recognition 33(12), 2099–2101 (2000)CrossRefzbMATHGoogle Scholar
  10. 10.
    De Stefano, C., Sansone, C., Vento, M.: To reject or not to reject: That is the question – an answer in case of neural classifiers. IEEE Trans. on Systems, Man and Cybernetics 30(1), 84–94 (2000)CrossRefGoogle Scholar
  11. 11.
    Landgrebe, T., Tax, D.M.J., Paclík, P., Duin, R.P.W.: The interaction between classification and reject performance for distance–based reject–option classifiers. Pattern Recognition Letters 27(8), 908–917 (2006)CrossRefGoogle Scholar
  12. 12.
    Vapnik, V.N.: Statistical Learning Theory. John Wiley and Sons, New York (1998)zbMATHGoogle Scholar
  13. 13.
    Schölkopf, B., Platt, J.C., Shawe–Taylor, J., Smola, A.J., Williamson, R.C.: Estimating the Support of a High–Dimensional Distribution. Neural Computation 13, 1443–1471 (2001)CrossRefzbMATHGoogle Scholar
  14. 14.
    Duda, R.O., Hart, P.E., Stork, D.G.: Pattern Classification, 2nd edn. Wiley, Chichester (2000)zbMATHGoogle Scholar
  15. 15.
    Rissanen, J.: Modeling by shortest data description. Automatica 14, 465–471 (1978)CrossRefzbMATHGoogle Scholar
  16. 16.

Copyright information

© Springer-Verlag Berlin Heidelberg 2008

Authors and Affiliations

  • Alice Este
    • 1
  • Francesco Gargiulo
    • 2
  • Francesco Gringoli
    • 1
  • Luca Salgarelli
    • 1
  • Carlo Sansone
    • 2
  1. 1.DEAUniversità degli Studi di BresciaBresciaItaly
  2. 2.Dipartimento di Informatica e SistemisticaUniversità degli Studi di Napoli Federico IINapoliItaly

Personalised recommendations