Machine learning for internet traffic classification

Abstract

Traffic classification acquired the interest of the Internet community early on. Different approaches have been proposed to classify Internet traffic to manage both security and Quality of Service (QoS). However, traditional classification approaches consisting of modifying the Transmission Control Protocol-Internet Protocol (TCP-IP) scheme have not been adopted due to their complex management. In addition, port-based methods and deep packet inspection have limitations in dealing with new traffic characteristics (e.g., dynamic port allocation, tunneling, encryption). Conversely, Machine Learning (ML) solutions effectively classify traffic down to the device type and specific user action. Different ML based methods have been applied for this aim. However, traditional ML methods rely on hand crafted features, limiting the model ability to learn. Deep learning (DL), a branch of ML, is characterized by its representation learning ability. on the other hand, intrusion detection systems (IDSes) have been proposed to detect and-or prevent security attacks by inspecting and detecting attacks patterns. However, traditional IDSes are rule based and present high management complexity. Alternatively, ML-based IDSes have emerged to overcome the management complexity issue. However, many of the proposed solutions are based on hand crafted features and considered datasets are outdated. In this thesis, we propose a new data representation method to apply DL for traffic classification and intrusion detection. For traffic classification, a hierarchical classification framework is proposed to classify the traffic based on different granularity levels. The defined classes reflect the different QoS and security needs. We analyse two methods of data representation for DL-based classification: a raw packet representation and a flow-based representation. Different tests are performed to evaluate the robustness of the considered data representation methods. These tests include features importance, model robustness, and anonymization te