How to Achieve High Classification Accuracy with Just a Few Labels: A Semi-supervised Approach Using Sampled Packets

TL;DR

This paper introduces a semi-supervised traffic classification method that achieves high accuracy using only a few labeled samples by leveraging large unlabeled datasets and transfer learning.

Contribution

It presents a novel semi-supervised approach that reduces the need for extensive labeled data in network traffic classification through pre-training on unlabeled data.

Findings

Achieves 98% accuracy with only 20 samples per class.

Effective across multiple datasets and protocols.

Sampling from any flow portion suffices for classification.

Abstract

Network traffic classification, which has numerous applications from security to billing and network provisioning, has become a cornerstone of today's computer networks. Previous studies have developed traffic classification techniques using classical machine learning algorithms and deep learning methods when large quantities of labeled data are available. However, capturing large labeled datasets is a cumbersome and time-consuming process. In this paper, we propose a semi-supervised approach that obviates the need for large labeled datasets. We first pre-train a model on a large unlabeled dataset where the input is the time series features of a few sampled packets. Then the learned weights are transferred to a new model that is re-trained on a small labeled dataset. We show that our semi-supervised approach achieves almost the same accuracy as a fully-supervised method with a large labeled dataset, though we use only 20 samples per class. In tests based on a dataset generated from the more challenging QUIC protocol, our approach yields 98% accuracy. To show its efficacy, we also test our approach on two public datasets. Moreover, we study three different sampling techniques and demonstrate that sampling packets from an arbitrary portion of a flow is sufficient for classification.