Network traffic classification: Techniques, datasets, and challenges

Network Traffic Classification (NTC) plays a critical role in modern network security and management, used in various applications such as performance monitoring, anomaly detection, and bandwidth management. Traditional methods like port-based identification and deep packet inspection (DPI) face limitations due to evolving encryption techniques and dynamic port usage. Recent advances in machine learning have improved NTC but often struggle with data labeling, encrypted traffic, and model complexity. This paper introduces a novel Information Bottleneck Neural Network (IBNN) to address these challenges by efficiently extracting essential features from raw traffic data while minimizing irrelevant information. The IBNN framework balances model complexity and discriminative feature preservation, leading to enhanced classification accuracy and robustness, particularly for encrypted traffic. Through information-centric feature extraction and relevant information compression, the proposed method outperforms existing techniques about 5–7% in terms of accuracy, as well as F1 score on both ISCX 2012 and UNB CIS datasets, delivering superior resilience and adaptability across diverse network scenarios. Extensive experiments demonstrate the efficacy of IBNN, positioning it as a significant advancement in the field of NTC.

People's increasing demand for high-quality network services has prompted the continuous attention and development of network traffic classification (NTC). In recent years, deep flow inspection (DFI) is considered to be the most effective and promising method to solve the NTC. However, DFI still cannot effectively address the problem of changes in flow characteristics of complex packet flows and the discovery of new traffic categories. In this paper, we propose a metric learning based deep learning solution with feature compressor, named deep flow embedding (DFE). The feature compressor is used to compress the feature information transmitted layer by layer in DL backbone while maintaining the computational accuracy, so that the backbone can remove as much noise, redundancy, and other irrelevant information from the input data as possible, and achieve more robust feature extraction of network traffic flow. The deep learning (DL) backbone generates an embedding vector for each network packet flow. Then the embedding vector is compared with the vector template preset for each traffic type in the template library to determine the category of the packet flow. Experimental results verify that our method is more effective than the traditional DFI methods in overcoming the problems of flow characteristics variation and new category discovery.

Wind energy has the possibility for bringing out energy in a very constant and sustainable manner being a notable and eligible source. Although, wind energy does include numerous challenges like, the halted asset of wind plants, early investment costs, and therefore, the strain in discovering areas of wind efficiency. The major objective for proposing this work is to determine the power efficiency of wind turbines, which will also aid in the formulation of a proposal to reduce wind turbine maintenance costs. During this research, data analysis of turbine generators is performed on day to day wind speed info using machine learning and deep learning algorithms. A way is put forward by us to support deep learning and machine learning algorithms which can predict different values of power reliably. Hence, the execution of machine and deep learning algorithms are analyzed. For forecasting for a longer term these algorithms may be used for wind generation rate with historical relation to wind speed info. Index Terms: Wind turbine,machine learning algorithm

This study presents a comparative analysis of the classification performance of facial and emotion recognition systems using Machine Learning (ML) and Deep Learning (DL) algorithms. The primary objective of this work is to evaluate the applicability of emotion recognition in fields such as psychotherapy and crime analysis, using the FER-2013 dataset.The study was conducted with ML algorithms such as Support Vector Machines (SVM), Random Forest (RF), K-Nearest Neighbor (KNN), Decision Trees, and Gradient Boosting, as well as the DL algorithm, Convolutional Neural Network (CNN). Supported by the application of feature selection, preprocessing, and feature extraction techniques, the model’s performance was measured using standard metrics such as accuracy, precision, F1-score, and AUC-ROC.The experimental results showed that the highest classification accuracy (46.61%) was achieved with the CNN model. While the ML models generally offered lower accuracy, they provided advantages in terms of computational efficiency in specific scenarios.This study aims to contribute to the literature by providing a comparative analysis of ML and DL algorithms and by highlighting the effect of data preprocessing on performance. The findings set targets for future work, such as real-time system integration and hybrid model development.

Smart city networks involve many applications that impose specific Quality of Service (QoS) requirements, thus representing a challenging scenario for network management. Solutions aiming to guarantee QoS support have not been deployed in large-scale networks. Traffic classification is a mechanism used to manage different aspects, including QoS requirements. However, conventional traffic classification methods, such as the port-based method, are inefficient because of their inability to handle dynamic port allocation and encryption. Traffic classification using machine learning has gained research interest as an alternative method to achieve high performance. In fact, machine learning embeds intelligence into network functions, thus improving network management. In this study, we apply machine learning algorithms to predict network traffic classification. We apply four supervised learning algorithms: support vector machine, random forest, k-nearest neighbors, and decision tree. We also apply a port-based method of traffic classification based on applications’ popular assigned port numbers. Then, we compare the results of this method to those obtained from the machine learning algorithms. The evaluation results indicate that the decision tree algorithm provides the highest average accuracy among the evaluated algorithms, at 99.18%. Moreover, network traffic classification using machine learning provides more accurate results and higher performance than the port-based method.

Network traffic classification plays an important role in various network activities. Due to the ineffectiveness of traditional port-based and payload-based methods, recent works proposed using machine learning methods to classify flows based on statistical characteristics. In this study, we evaluate the effectiveness of machine learning techniques on the real-time traffic classification problem. We identify the most suitable ML classifier for network traffic classification by comparing various ML schemes,including both supervised and unsupervised methods. We also apply feature selection to identify significant features. Finally, we simulate real-time classification by using features derived from the first few packets of each flow.The results show that classifiers based on decision tree outperform others on both accuracy and performance; and that classifiers based on early flow properties can achieve high accuracy while reducing the computational complexity.

Accurate network traffic classification is essential for network management. However, existing network traffic classification methods cannot meet the demand of real networks in terms of classification performance, user privacy, latency, and control overhead. Thus, a machine learning-based approach has been used for network traffic classification. In this paper, we propose a network traffic classification framework using software-defined network (SDN) architecture. The proposed framework is entirely located in the network controller; thus, we can leverage the superior computational capacity, global visibility, and programmability of the SDN controller to realize real-time, adaptive, and accurate traffic classification. We also apply four ensemble algorithms and analyze their classification performance in terms of accuracy, precision, recall, F1-score, training time, and classification time. The experimental results reveal that ensemble model-based network traffic classifiers outperform other classifiers based on the proposed framework and the real-world network traffic dataset. Notably, the LightGBM model achieves the best classification performance.

The rapid global growth of the internet, driven by advancements in fiber and 5G technology, multi-device access, and affordable services, has increased the pressure on internet service providers to classify network traffic efficiently. Accurate traffic classification and protocol identification are critical for detecting malicious activity. This study introduces a new method that enhances machine learning and deep learning models by applying hashing techniques to convert string-based IP addresses into numerical values. The improved models demonstrate a significant boost in accuracy, increasing from 76% to 83%, along with better recall and F1-scores in key categories. These findings highlight the potential of hashing techniques to improve the performance of machine learning models in network traffic classification tasks.

Deep learning has gained immense popularity in scientific computing, and its algorithms are widely used in complex problem-solving industries. Every deep learning algorithm use different types of neural networks to perform indented tasks. Deep learning (DL) algorithms have emerged from different machine learning and soft computing methodologies. Since then, a number of deep learning (DL) algorithms have been recently introduced in the scientific community and applied in various application fields. Today, the use of DLs has become indispensable due to their intelligence, effective learning, accuracy and reliability in model creation. However, a comprehensive list of DL algorithms has not yet been presented in the scientific literature. This article lists the most popular DL algorithms and their application areas. Deep learning uses ANN artificial neural networks to perform convoluted calculations on huge amounts of data. It is a type of machine learning based on the structure and function of the human brain. Deep learning algorithms train machines by learning from examples. Industries such as healthcare, e-commerce, entertainment and advertising often use deep learning.

The upcoming deployment of sixth-generation (6G) wireless networks promises to significantly outperform 5G in terms of data rates, spectral efficiency, device densities, and, most importantly, latency and security. To cope with the increasingly complex network traffic, Network Traffic Classification (NTC) will be essential to ensure the high performance and security of a network, which is necessary for advanced applications. This is particularly relevant in the Internet of Things (IoT), where resource-constrained platforms at the edge must manage tasks like traffic analysis and threat detection. In this context, balancing classification accuracy with computational efficiency is key to enabling practical, real-world deployments. Traditional payload-based and packet inspection methods are based on the identification of relevant patterns and fields in the packet content. However, such methods are nowadays limited by the rise of encrypted communications. To this end, the research community has turned its attention to statistical analysis and Machine Learning (ML). In particular, Convolutional Neural Networks (CNNs) are gaining momentum in the research community for ML-based NTC leveraging statistical analysis of flow characteristics. Therefore, this paper addresses CNN-based NTC in the presence of encrypted communications generated by the rising Quick UDP Internet Connections (QUIC) protocol. Different models are presented, and their performance is assessed to show the trade-off between classification accuracy and CNN complexity. In particular, our results show that even simple and low-complexity CNN architectures can achieve almost 92% accuracy with a very low-complexity architecture when compared to baseline architectures documented in the existing literature.

Internet of Things (IoT) systems are rightly receiving considerable interest for many real-world applications, from in-body networks to satellite networks. Such a massive-scale system generates a considerable amount of traffic data, making IoT systems a distributed data source generator. For many reasons, such as the functionality of IoT applications and Quality of Service (QoS) provisioning, classifying these traffic data is of high importance. In the last few years, widespread interest has been expressed in applying Machine Learning (ML)-based techniques for Network Traffic Classification (NTC) tasks. However, the traditional centralized learning-based traffic classifiers pose serious challenges, especially in IoT networks. The centralized ML techniques call for collecting a large amount of data from various IoT devices, which in turn introduces data governance and privacy challenges. Furthermore, in the centralized ML, training data need to be transferred to the Cloud, which increases communication cost and latency. To address these problems, we propose Federated Learning (FL) Internet of Things (IoT) Traffic Classifier (FLITC)-a Federated Learning (FL)-based IoT traffic classification method which is based on the Multi-Layer Perception (MLP) neural network and holds the local data unimpaired on IoT devices by sending only the learned parameters to the aggregation server. Our experimental results show that the FLITC beats centralized learning in preserving the privacy of sensitive data and offers a better degree of accuracy at the cost of a longer training time.

Network traffic classification for data fusion: A survey

Feature mining for encrypted malicious traffic detection with deep learning and other machine learning algorithms

Network traffic classification is a fundamental research topic on high-performance network protocol design and network operation management. Compared with other state-of-the-art studies done on the network traffic classification, machine learning ML methods are more flexible and intelligent, which can automatically search for and describe useful structural patterns in a supplied traffic dataset. As a typical ML method, support vector machines SVMs based on statistical theory has high classification accuracy and stability. However, the performance of SVM classifier can be severely affected by the data scale, feature dimension, and parameters of the classifier. In this paper, a real-time accurate SVM training model named SPP-SVM is proposed. An SPP-SVM is deducted from the scaling dataset and employs principal component analysis PCA to extract data features and verify its relevant traffic features obtained from PCA. By employing PCA algorithm to do the dimension extraction, SPP-SVM confirms the critical component features, reduces the redundancy among them, and lowers the original feature dimension so as to reduce the over fitting and increase its generalization effectively. The optimal working parameters of kernel function used in SPP-SVM are derived automatically from improved particle swarm optimization algorithm, which will optimize the global solution and make its inertia weight coefficient adaptive without searching for the parameters in a wide range, traversing all the parameter points in the grid and adjusting steps gradually. The performance of its two- and multi-class classifiers is proved over 2 sets of traffic traces, coming from different topological points on the Internet. Experiments show that the SPP-SVM's two- and multi-class classifiers are superior to the typical supervised ML algorithms and performs significantly better than traditional SVM in classification accuracy, dimension, and elapsed time.

Network traffic classification is the process of analyzing traffic flows and associating them to different categories of network applications. Network traffic classification represents an essential task in the whole chain of network security. Some of the most important and widely spread applications of traffic classification are the ability to classify encrypted traffic, the identification of malicious traffic flows, and the enforcement of security policies on the use of different applications. Passively monitoring a network utilizing low-cost and low-complexity wireless local area network (WLAN) devices is desirable. Mobile devices can be used or existing office desktops can be temporarily utilized when their computational load is low. This reduces the burden on existing network hardware. The aim of this paper is to investigate traffic classification techniques for wireless communications. To aid with intrusion detection, the key goal is to passively monitor and classify different traffic types over WLAN to ensure that network security policies are adhered to. The classification of encrypted WLAN data poses some unique challenges not normally encountered in wired traffic. WLAN traffic is analyzed for features that are then used as an input to six different machine learning (ML) algorithms for traffic classification. One of these algorithms (a Gaussian mixture model incorporating a universal background model) has not been applied to wired or wireless network classification before. The authors also propose a ML algorithm that makes use of the well-known vector quantization algorithm in conjunction with a decision tree—referred to as a TRee Adaptive Parallel Vector Quantiser. This algorithm has a number of advantages over the other ML algorithms tested and is suited to wireless traffic classification. An average F-score (harmonic mean of precision and recall) > 0.84 was achieved when training and testing on the same day across six distinct traffic types.