An accurate traffic classification model based on support vector machines

The importance of Power Transmission System PTS fault detection and classification is increasing day by day as because consumption of electricity is increasing. Short circuit fault in Power Transmission Line Network PTLN can cause severe damage to the power transmission system as well as economic loss. Power Transmission System requires new methods to detect and classify fault behaviour to prevent it from heavy damage. Machine Learning ML algorithms can be very effective to classify and detect various types of faults within the PTLN. There are variety of ML algorithms to recognise and classify the faults but as complexity of PTS is increasing day by day, reliability of these algorithms is decreasing. This study uses various types of ML algorithms to generate predictive models to evaluate what kind of algorithm is more appropriate to recognise and classify faults within the PTLN. Faults investigated in this research work include (L-L) double line fault, (L-L-L) three phase fault, (L-G) line to ground fault, (L-L-G) double line to ground fault, and (L-L-L-G) three phase fault with the involvement of the ground. The data was evaluated using six (06) ML algorithms that are Decision Tree, Support Vector Machine (SVM), K-Nearest Neighbor (Knn), Random Forest, XGBoost (XGB) and Naive Bayes (NB) for recognise of fault and classification within the PTLN. The performance of ML algorithms obtained by comparing the results and determine which algorithm is fast and more accurate. These results can be used to create more effective ML algorithms for PTS. The results indicate that the application of ML algorithms for PTS task could improve the PTLN yield and save time for technical teams.

Smart city networks involve many applications that impose specific Quality of Service (QoS) requirements, thus representing a challenging scenario for network management. Solutions aiming to guarantee QoS support have not been deployed in large-scale networks. Traffic classification is a mechanism used to manage different aspects, including QoS requirements. However, conventional traffic classification methods, such as the port-based method, are inefficient because of their inability to handle dynamic port allocation and encryption. Traffic classification using machine learning has gained research interest as an alternative method to achieve high performance. In fact, machine learning embeds intelligence into network functions, thus improving network management. In this study, we apply machine learning algorithms to predict network traffic classification. We apply four supervised learning algorithms: support vector machine, random forest, k-nearest neighbors, and decision tree. We also apply a port-based method of traffic classification based on applications’ popular assigned port numbers. Then, we compare the results of this method to those obtained from the machine learning algorithms. The evaluation results indicate that the decision tree algorithm provides the highest average accuracy among the evaluated algorithms, at 99.18%. Moreover, network traffic classification using machine learning provides more accurate results and higher performance than the port-based method.

Network traffic classification for data fusion: A survey

Accurate network traffic classification is essential for network management. However, existing network traffic classification methods cannot meet the demand of real networks in terms of classification performance, user privacy, latency, and control overhead. Thus, a machine learning-based approach has been used for network traffic classification. In this paper, we propose a network traffic classification framework using software-defined network (SDN) architecture. The proposed framework is entirely located in the network controller; thus, we can leverage the superior computational capacity, global visibility, and programmability of the SDN controller to realize real-time, adaptive, and accurate traffic classification. We also apply four ensemble algorithms and analyze their classification performance in terms of accuracy, precision, recall, F1-score, training time, and classification time. The experimental results reveal that ensemble model-based network traffic classifiers outperform other classifiers based on the proposed framework and the real-world network traffic dataset. Notably, the LightGBM model achieves the best classification performance.

Privacy information theft traffic is usually detected using traffic classification methods, and deep learning-based detection methods are effective for this task. However, these methods have complex preprocessing processes as well as tend to ignore the deep features of network traffic, while the generalization ability is not outstanding. In this paper, a network traffic classification and detection model TCCN (Traffic Classification Capsule Network) based on capsule network is proposed. Meanwhile, PacketCGAN-based data balancing method is introduced to assist TCCN in traffic classification. A new feature graph vectorization method is used to improve the efficiency of TCCN. In addition, TCCN uses dynamic routing mechanism that can retain more valid traffic characteristics. In parallel, this paper proposes a new loss function to improve the generalization performance of TCCN. The results show that TCCN can show good performance in different experimental scenarios. After effective training, TCCN can also show high detection accuracy in new datasets, and the generalization ability of the model reaches a relatively excellent level.

Recently, with the advent of various Internet of Things (IoT) applications, a massive amount of network traffic is being generated. A network operator must provide different quality of service, according to the service provided by each application. Toward this end, many studies have investigated how to classify various types of application network traffic accurately. Especially, since many applications use temporary or dynamic IP or Port numbers in the IoT environment, only payload-based network traffic classification technology is more suitable than the classification using the packet header information as well as payload. Furthermore, to automatically respond to various applications, it is necessary to classify traffic using deep learning without the network operator intervention. In this study, we propose a traffic classification scheme using a deep learning model in software defined networks. We generate flow-based payload datasets through our own network traffic pre-processing, and train two deep learning models: 1) the multi-layer long short-term memory (LSTM) model and 2) the combination of convolutional neural network and single-layer LSTM models, to perform network traffic classification. We also execute a model tuning procedure to find the optimal hyper-parameters of the two deep learning models. Lastly, we analyze the network traffic classification performance on the basis of the F1-score for the two deep learning models, and show the superiority of the multi-layer LSTM model for network packet classification.

This project aims to develop a traffic classification system utilizing machine learning algorithms contributing to a more resilient digital environment. In the realm of cyber security DDos attacks continue to threaten online services. This project proposes a “Traffic Classification System Using Machine Learning Algorithms” as a defence against such attacks. The projects core objective is to build a system that can effectively distinguish between legitimate network Traffic and malicious DDos attack. Term effectiveness against evolving threats. Scale and perform efficiently even in large-scale networks, maintaining real-time detection capabilities. We analyse various ML methods and algorithms, conduct data analysis and model develop ment, and evaluate the effectiveness of the proposed approach. The results demonstrate that ML-based traffic classification and DDoS attack detection offers a powerful and practical solution for enhancing network security. Keywords: Traffic Classification, KNearest Neighbour, Logistic Regression, DDOS Attack

The theoretical analysis of multiclass classification has proved that the existing multiclass classification methods can train a classifier with high classification accuracy on the test set, when the instances are precise in the training and test sets with same distribution and enough instances can be collected in the training set. However, one limitation with multiclass classification has not been solved: how to improve the classification accuracy of multiclass classification problems when only imprecise observations are available. Hence, in this article, we propose a novel framework to address a new realistic problem called multiclass classification with imprecise observations (MCIMO), where we need to train a classifier with fuzzy-feature observations. First, we give the theoretical analysis of the MCIMO problem based on fuzzy Rademacher complexity. Then, two practical algorithms based on support vector machine and neural networks are constructed to solve the proposed new problem. The experiments on both synthetic and real-world datasets verify the rationality of our theoretical analysis and the efficacy of the proposed algorithms.

The successful deployment of ML methods depends on their transparency (or explainability). We refer to techniques that aim at making ML method transparent (or explainable) as explainable ML. Providing explanations for the predictions of a ML method is particulary important when these predictions inform decision making [1]. Explanations for automated decision making system have become a legal requirement [2].

Network traffic classification is the process of analyzing traffic flows and associating them to different categories of network applications. Network traffic classification represents an essential task in the whole chain of network security. Some of the most important and widely spread applications of traffic classification are the ability to classify encrypted traffic, the identification of malicious traffic flows, and the enforcement of security policies on the use of different applications. Passively monitoring a network utilizing low-cost and low-complexity wireless local area network (WLAN) devices is desirable. Mobile devices can be used or existing office desktops can be temporarily utilized when their computational load is low. This reduces the burden on existing network hardware. The aim of this paper is to investigate traffic classification techniques for wireless communications. To aid with intrusion detection, the key goal is to passively monitor and classify different traffic types over WLAN to ensure that network security policies are adhered to. The classification of encrypted WLAN data poses some unique challenges not normally encountered in wired traffic. WLAN traffic is analyzed for features that are then used as an input to six different machine learning (ML) algorithms for traffic classification. One of these algorithms (a Gaussian mixture model incorporating a universal background model) has not been applied to wired or wireless network classification before. The authors also propose a ML algorithm that makes use of the well-known vector quantization algorithm in conjunction with a decision tree—referred to as a TRee Adaptive Parallel Vector Quantiser. This algorithm has a number of advantages over the other ML algorithms tested and is suited to wireless traffic classification. An average F-score (harmonic mean of precision and recall) > 0.84 was achieved when training and testing on the same day across six distinct traffic types.

Support vector machine is a machine learning method. It takes on the good generalization ability and prediction accuracy. But the parameters of SVM model seriously affect the generalization ability and prediction accuracy of SVM model on the great extent. So an improved particle swarm optimization (PSO) algorithm based on chaotic search is introduced into the SVM model in propose a novel data classification (AMPSVM) method for processing the complex data. The first, the ergodicity, stochastic property, and regularity of chaos is used to chaotically search the current best individual, which randomly replaces the selected individual in the population in order to speed up evolution, improve the searching ability, convergence speed and accuracy. Then the improved PSO algorithm is used to select and optimize the parameters of the SVM (AMPSVM) model in order to improve the learning performance and generalization ability of the SVM model. In order to verify the effectiveness of the AMPSVM method, UCI data is selected in here. The experiment results show that the proposed AMPSVM method takes on the strong generalization ability, best sensitivity and higher classification accuracy.

Malicious traffic classification has become a challenge in modern communications. It is a very important task for a trained model to successfully distinguish malicious traffic. With the gradual application of machine learning and deep learning in the field of traffic classification, traffic classification has reached a high accuracy rate. Feature selection can lighten models and improve classification performance by selecting the optimal sub-feature set. Therefore, the selection of effective features is an important issue for malicious traffic classification. In this article, we propose the idea of applying feature selection methods Information Gain and RFE to malicious traffic classification. The essence is to select an effective and optimal sub-feature set from a large number of features to characterize network traffic. Then, we used the deep learning method CNN and the machine learning method RF on the three real network traffic datasets of CICIDS2017, NSL-KDD and UNSW-NB15 respectively to evaluate and verify. The experiment shows that the combination of CNN and Information Gain has the best effect. The results of many experiments show that the performance of traffic classification is greatly improved after feature selection.

Machine Learning Compared With Conventional Statistical Models for Predicting Myocardial Infarction Readmission and Mortality: A Systematic Review

As an essential task for network management and security, network traffic classification has attracted increasing attention in recent years. Traditional traffic classification methods achieve certain success in identifying specific application traffic but fail with un-predefined unknown classes. Existing unknown traffic discovery methods commonly pick out some unlabeled testing data as part of training data to train the classification models, which is not in line with the real-world open environments. In this paper, we propose a novel scheme named SEEN to achieve unknown traffic detection in network traffic classification. There are three crucial phases in the SEEN: unknown discovery, unknown clustering, and system update. In the first step, using a metric-based approach with siamese network, SEEN identifies unknown traffic as well as accurately classifies the traffic generated by pre-defined application classes. After discovery, unknown traffic is automatically clustered into more fine-grained categories in the unknown clustering step. In the system update step, inspired by low-shot learning, SEEN allows new classes to be added or unnecessary known classes to be deleted quickly without retraining from the sketch, which can complement the system’s knowledge. Experimental results exhibit that SEEN can achieve outstanding performances both on known and unknown traffic identification on two open real-world datasets, and the proposed scheme can address the problem of unknown traffic effectively.

Deep learning has been applied in the field of network intrusion detection and has yielded good results. In malicious network traffic classification tasks, many studies have achieved good performance with respect to the accuracy and recall rate of classification through self-designed models. In deep learning, the design of the model architecture greatly influences the results. However, the design of the network model architecture usually requires substantial professional knowledge. At present, the focus of research in the field of traffic monitoring is often directed elsewhere. Therefore, in the classification task of the network intrusion detection field, there is much room for improvement in the design and optimization of the model architecture. A neural architecture search (NAS) can automatically search the architecture of the model under the premise of a given optimization goal. For this reason, we propose a model that can perform NAS in the field of network traffic classification and search for the optimal architecture suitable for traffic detection based on the network traffic dataset. Each layer of our depth model is constructed according to the principle of maximum coding rate attenuation, which has strong consistency and symmetry in structure. Compared with some manually designed network architectures, classification indicators, such as Top-1 accuracy and F1 score, are also greatly improved while ensuring the lightweight nature of the model. In addition, we introduce a surrogate model in the search task. Compared to using the traditional NAS model to search the network traffic classification model, our NAS model greatly improves the search efficiency under the premise of ensuring that the results are not substantially different. We also manually adjust some operations in the search space of the architecture search to find a set of model operations that are more suitable for traffic classification. Finally, we apply the searched model to other traffic datasets to verify the universality of the model. Compared with several common network models in the traffic field, the searched model (NAS-Net) performs better, and the classification effect is more accurate.