Cross-Domain Elephant Flow Detection: A Unified Machine Learning Approach with Application-Aware and Security Features

TL;DR

This paper introduces a unified machine learning framework for cross-domain elephant flow detection, incorporating application-aware and security features to improve robustness and accuracy across diverse network environments.

Contribution

It presents a novel cross-domain elephant flow detection approach that combines adaptive thresholding, comprehensive feature engineering, and evaluation across multiple datasets.

Findings

Significant performance variation across domains (F1-scores 0.37 to 0.97)

Unified model achieves an F1 score of 0.99 in cross-validation

Size-based features are most influential, but application-aware features enhance accuracy

Abstract

Network traffic classification, particularly elephant flow detection, faces significant challenges when deployed across heterogeneous network environments. While existing approaches demonstrate high accuracy within single domains, they suffer from poor generalization due to domain shift phenomena. This paper presents a unified machine learning framework for cross domain elephant flow detection that incorporates application aware and security features to enhance robustness across diverse network environments. Our approach addresses the critical gap in existing literature by evaluating model performance across three distinct domains: Campus networks, UNSW-NB15, and CIC-IDS2018 datasets. This paper proposes a unified pipeline that employs adaptive thresholding, comprehensive feature engineering, and cross-domain evaluation to quantify and mitigate domain shift effects. Experimental results demonstrate significant performance variations across domains (F1-scores ranging from 0.37 to 0.97), highlighting the importance of cross-domain validation. The unified model achieves an overall cross-validation F1 score of 0.99 while maintaining interpretability through feature importance analysis. Our findings reveal that while size based features dominate elephant flow detection (33.80% importance for total bytes), application-aware and security features contribute to improved classification accuracy and provide valuable insights for network management and security applications.