ITCM: A Real Time Internet Traffic Classifier Monitor

TL;DR

This paper presents a real-time network traffic classification system that uses a modular pipeline with machine learning algorithms, achieving low delay and allowing independent module improvements.

Contribution

It introduces a flow-based classification system with a concurrent pipeline architecture and compares multiple ML algorithms for effective real-time traffic analysis.

Findings

Average delay of 0.49 seconds in flow reassembly

KNN, C4.5, NB, FNB, and AdaBoost evaluated for classification performance

Modular pipeline allows independent updates of system components

Abstract

The continual growth of high speed networks is a challenge for real-time network analysis systems. The real time traffic classification is an issue for corporations and ISPs (Internet Service Providers). This work presents the design and implementation of a real time flow-based network traffic classification system. The classifier monitor acts as a pipeline consisting of three modules: packet capture and pre-processing, flow reassembly, and classification with Machine Learning (ML). The modules are built as concurrent processes with well defined data interfaces between them so that any module can be improved and updated independently. In this pipeline, the flow reassembly function becomes the bottleneck of the performance. In this implementation, was used a efficient method of reassembly which results in a average delivery delay of 0.49 seconds, approximately. For the classification module, the performances of the K-Nearest Neighbor (KNN), C4.5 Decision Tree, Naive Bayes (NB), Flexible Naive Bayes (FNB) and AdaBoost Ensemble Learning Algorithm are compared in order to validate our approach.