Internet Traffic Classification Using Bayesian Analysis Techniques

Internet Traffic Classification Using Bayesian Analysis Techniques

June 6-10, 2005, Banff, Alberta, Canada | Andrew W. Moore, Denis Zuev
This paper presents a study on the classification of Internet traffic using Bayesian analysis techniques, specifically the Naïve Bayes estimator. The authors apply a supervised Naïve Bayes classifier to categorize traffic by application, using hand-classified network data as input. The study demonstrates that the Naïve Bayes estimator can achieve high accuracy in classifying network flows, with results ranging from 65% to over 95% accuracy depending on the refinement of the estimator. The authors emphasize that their approach uses only header-derived discriminators, which are commonly available, allowing for the categorization of traffic without requiring full packet content. The study compares the performance of the Naïve Bayes estimator with traditional techniques, which typically achieve accuracy between 50–70%. The authors also explore refinements of the Naïve Bayes estimator, such as kernel density estimation and feature selection using the Fast Correlation-Based Filter (FCBF) method, which further improve classification accuracy. The results show that the Naïve Bayes estimator, when combined with these refinements, achieves high accuracy in classifying traffic into different categories, such as BULK, MAIL, WWW, and ATTACK. The study also evaluates the performance of the Naïve Bayes estimator using different datasets and time periods, demonstrating that the method is robust and can maintain high accuracy even when applied to new data. The authors conclude that the Naïve Bayes estimator, with its refinements, is a powerful tool for classifying Internet traffic and can be applied to a wide range of network activities, including security monitoring, accounting, and Quality of Service. The study highlights the importance of using header-derived discriminators and the effectiveness of Bayesian techniques in accurately classifying network traffic.This paper presents a study on the classification of Internet traffic using Bayesian analysis techniques, specifically the Naïve Bayes estimator. The authors apply a supervised Naïve Bayes classifier to categorize traffic by application, using hand-classified network data as input. The study demonstrates that the Naïve Bayes estimator can achieve high accuracy in classifying network flows, with results ranging from 65% to over 95% accuracy depending on the refinement of the estimator. The authors emphasize that their approach uses only header-derived discriminators, which are commonly available, allowing for the categorization of traffic without requiring full packet content. The study compares the performance of the Naïve Bayes estimator with traditional techniques, which typically achieve accuracy between 50–70%. The authors also explore refinements of the Naïve Bayes estimator, such as kernel density estimation and feature selection using the Fast Correlation-Based Filter (FCBF) method, which further improve classification accuracy. The results show that the Naïve Bayes estimator, when combined with these refinements, achieves high accuracy in classifying traffic into different categories, such as BULK, MAIL, WWW, and ATTACK. The study also evaluates the performance of the Naïve Bayes estimator using different datasets and time periods, demonstrating that the method is robust and can maintain high accuracy even when applied to new data. The authors conclude that the Naïve Bayes estimator, with its refinements, is a powerful tool for classifying Internet traffic and can be applied to a wide range of network activities, including security monitoring, accounting, and Quality of Service. The study highlights the importance of using header-derived discriminators and the effectiveness of Bayesian techniques in accurately classifying network traffic.
Reach us at info@study.space