Journal of Engineering Science and Technology Review 7 (3) (2014) Research Article

Transcription

1 Jestr Journal of Engneerng cence and Technology Revew 7 (3) (2014) Research Artcle JOURAL OF Engneerng cence and Technology Revew Traffc Classfcaton Method by Combnaton of Host Behavour and tatstcal Approach Yng Hou 1,*, Ha Huang 1, Wenchao hao 1 and Heqng Huang 2 1 atonal gtal wtchng ystem Engneerng & Techologcal R& Center, ZhengZhou , Chna 2 Unversty of Kentucky,Lexngton, KY , UA Receved 2 February 2014; Accepted 27 July 2014 Abstract Traffc classfcaton, one of the most actve felds n Internet traffc research, s the substructure of network desgn and management. Generally, there are four technques to dentfy the traffc, port-based, payload-based, flow statstc-based, and host-based approaches. In ths paper, a hybrd method to classfy the traffc was proposed combnng the host behavour and the Affnty Propagaton (AP) algorthm. mple features n the statstcal process were selected at the frst stage of classfcaton; then, the ntal classfcaton results and the host behavour model were combned to generate the fnal results. The host behavour model was updated by the feedback of prevous classfcaton. The combnng classfcaton approach was evaluated on two real traces. The results ndcated that the proposed technque offered mproved performance compared wth BLIC and ndependent AP algorthms. Keywords: Traffc Classfcaton, Affnty Propagaton, tatstcal Feature, Host Behavour 1. Introducton The percepton of the traffc applcaton s the mportant means n the feld of network optmzng, resources allocaton and abnormal behavor detecton etc. It can be consdered as the foundaton of network management that contrbutes to deeply understand the nature of the network and effectvely master the state of the network. In recent years, a large number of new technologes have been ntroduced to serve the needs of ever ncreasng scale of the Internet and ts archtecture. Ths development has also posed sever challenges to the traffc classfcaton. The conventonal port-based approach s the fastest and smplest method to dentfy the applcatons of traffc. However, some modern applcatons whch select the ports randomly are extremely dffcult to be dentfed by the portbased approaches. Moreover, to trck frewalls, some applcatons conceal themselves by usng standard ports of other applcatons, such as port 80. The ports are determned by applcatons, and can be easly changed by the end host. Hence, the port-based approach s less relable [1]. The payload-based approaches, usually called eep Packet Inspecton (PI) [2], have been wdely appled n traffc dentfcaton feld, partcularly n network securty. These technques dentfy the applcatons by matchng the payload of packets and the characterstc strng assocated wth the applcatons, called applcaton sgnature. When a new applcaton appears, the sgnatures need to be found and labeled. The payload-based approaches are generally relable except the formdable prvacy and laws challenges. Besdes, the exploraton of the packets payload nduces heavy load and hgh cost. That lmts the general use on hgh-bandwdth * E-mal address: ndschy@139.com I: Kavala Insttute of Technology. All rghts reserved. lnks. And now many modern applcatons wth encrypted payloads lead to ths technology n van[3]. The flow statstc-based technques, also called eep Flow Inspecton (FI), recognze the applcatons through a classfer based on machne learnng methods. The classfer dentfes the applcaton based on the statstcal sgnatures of the traffc[4][5]. The statstcal sgnatures can be packet szes, connecton duratons, nter-packet delays, or drecton of the flow, etc. The machne learnng methods nclude supervsed algorthms, unsupervsed algorthms, and semsupervsed algorthms. In the supervsed algorthms, the classfer s bult on the tranng samples, whch have been labeled the applcatons. The unclassfed traffc s dentfed by matchng the statstcal sgnatures of the classfer establshed by the tranng sample. When a new applcaton appears, the classfer must be retraned. n unsupervsed algorthms, the classes needn t be predetermned. The algorthms construct dstnct classes (e.g., clusterng) of traffc and then assgn these classes to correspondng applcatons. In [6], McGregor et al. presented the clusterng algorthms (EM) to the dentfcaton process. Unsupervsed algorthm do not requre the nformaton of samples and can dentfy the obfuscated and encrypted traffc. In emalgorthm, The clusterng also plays key role and the tranng samples are taken nto account for the applcaton assgnment. The host-based approach s a new branch of traffc classfcaton. It explots the host behavor to resolve the classfcaton ssue. These algorthms apply the heurstcs theory to perform the classfcaton effectvely, especally for obfuscated traffc. ome of the recent studes have focused on ths aspect[7]. In [7], the socal network of a gven host s correlated wth ts transport-level nteractons to dentfy peer-to-peer applcaton. Wth the development of the Internet applcatons, a sngle traffc classfcaton technque can t acheve

2 Yng Hou, Ha Huang, Wenchao hao and Heqng Huang/Journal of Engneerng cence and Technology Revew 7 (3) (2014) acceptable accuracy[9]. The researchers have started to consder more general and effectve technques that use several classfers and combne the results of dfferent classfers by ntellgent hybrd algorthms. It s clamed that the combnaton of a set of classfers may compensate for the weakness of a sngle classfer n the classfcaton process[10]. uch a mult-classfer system can acheve hgher accuracy compared to a sngle classfer, and t s more robust to the varaton of the sample populaton, ncludng the nature and mx of applcatons. ome of the mult-classfer systems pay attenton to the combnaton of same classfers wth dfferent parameters; whle others combne several dfferent classfers (such as port-based classfer and flow statstcal classfer). The combnaton of mult classfers are usually based on votng, Bayesan probablty, or empster-hafer theory. The combnaton of mult classfers results n ncreased computatonal complexty. However, Alberto[9] has ndcated that assumng dfferent classfers n the combnaton can execute n parallel, the flexblty offered by combnaton classfers facltates the scalablty trade-offs, essental for onlne technques. In ths paper, a hybrd approach s proposed that combnes the host behavor and FI classfer to categorze Internet traffc. The proposed approach nvolves three maor steps. In the frst phase, the ntal classfcaton of the traffc s performed by an teratve statstcal algorthm called Affnty Propagaton (AP). As second step, the results of ntal classfcaton are refned wth the host behavor model. Fnally, the host behavor model s updated based on the classfcaton results. The rest of the paper s organzed as follows. ecton 2 ntroduces AP algorthm and the features selected n ths study. ecton 3 descrbes the methodology to portray the host behavor. ecton 4 descrbes the combnaton of the two methods. ecton 5 dscusses the experments and the evaluaton results. Fnally, concluson s presented n ecton 6. representatve ponts that have maxmum smlarty among a subset of ponts and test data s classfed by fndng the nearest representatve pont. If the smlarty s equal to the negatve value of the Eucldean dstance, the obectve functon of AP s consstent wth K-means; that mnmzes the quadratc sum dstance of the data pont to the nearest representatve pont. In AP algorthm, consderng all the data ponts as canddates of representatve pont, avods the lmtatons assocated wth selecton of the ntal representatve pont. It s smple and effcent due to the optmzaton obectve functon that propagates smlarty. Furthermore, t does not rely on the symmetrcal nature of the smlarty between the data ponts. The smlarty matrx of n sample ponts s the key structure of AP algorthm. All of the n sample ponts are consdered as canddate representatve pont (.e. potental cluster center). For each pont, a n n smlarty matrx n n s establshed to ndcate ts attracton to other ponts. 2 s (, ) X X ( ) ndcates the degree of X beng the representatve pont of X. Large s (,) means that there s more probablty of X beng a representatve pont. There are two messages delvered to each pont,.e., responsblty and avalablty. The parameter rk (, ) descrbes the degree of k beng the representatve pont of. Whle ak (, ) descrbes the degree of selectng the data pont k as ts representatve pont. The parameters rk (, ) and ak (, ) are set to 0 ntally and updated n turn. The update process s as follows: { } r (, ) s (, ) max ak (, ) + sk (, ) a (, ) k r + r mn 0, (, ) max(0, (, )),, k max(0, r (, )), (1) 2. AP algorthm AP algorthm[11] s an unsupervsed clusterng method based on the dssemnaton of the nearest neghbor nformaton. The goal of ths algorthm s to fnd the optmal A dampng factor λ s ntroduced to mprove the convergence of the algorthm. The weghtng update process s descrbed n equaton (2): { { k } () t ( t 1) ( t 1) r λ r + λ s a k + s k (, ) (, ) (1 ) (, ) max (, ) (, ) ( t 1) ( t 1) ( t 1) λ a (, ) + (1 λ) mn 0, r (, ) + max(0, r (, )), () t, k a (, ) (2) ( t 1) ( t 1) λ a (, ) + (1 λ) max(0, r (, )), 0 λ < 1 A cluster set CC { 1,... C k } and representatve ponts set ww {... w} are establshed after clusterng. When there are The teratve process gven n equaton (2) termnates when one of the followng condtons s fulflled: a) current teraton exceeds the maxmum number of teratons; b) the step sze s under a fxed threshold; c) the representatve ponts are stable. () () After the teratve process, arg max ( t t a (, ) + r (, ) ) s calculated, and X s selected as the representatve pont of X. 1 k some labeled samples, the applcaton wth the maxmum samples n a certan cluster s set to that cluster. When there are no samples n the cluster, the cluster s dentfed as unknown applcaton. The statstcal features n AP algorthm are shown n Table

3 Yng Hou, Ha Huang, Wenchao hao and Heqng Huang/Journal of Engneerng cence and Technology Revew 7 (3) (2014) Tab. 1 elected features of traffc classfcaton feasure port P 1~P pattern(b 1b 2 b ) descrpton transport-layer ports the frst packets sze communcaton pattern The transport layer port s not a maor feature n traffc classfcaton. However, t s stll one of the mportant features, especally n classfcaton of some of the tradtonal applcatons n Internet. Zhang[12] has proved by statstcal methods that t can get relatvely hgh classfcaton accuracy, by usng the features of the frst four packets. Packets sze s commonly used n traffc classfcaton. The communcaton pattern defned n [13] s used to descrbe the drecton of the frst packets (except the control packets, e.g., Y, RT, FI) and sgnfy by a bnary nteger bb 1 2 L b, b( ) ; ths sgnfes the drecton of th packet. The parameter b 1when the drecton of th packet s same as the Y drecton n TCP, otherwse b 0. Let 4, n general, the communcaton pattern of FTP s 0101, and that of HTTP may be Tab. 2 Communcaton pattern of four applcatons statstc n WIE data set pattern FTP HTTP BtTorrent eonkey Table 2 shows the communcaton pattern of the statstcs of four applcatons from WIE data set[14]. The FTP and HTTP are representatve applcatons of C/. It can be seen from the table that 92.84% of the patterns of FTP s 0101, and 74.39% of HTTP s BtTorrent and eonkey are P2P applcatons; ther patterns are manly 1010 and AP clusterng algorthm keeps lookng untl the hghest assgnment probablty exceed a predetermned threshold or the maxmum detecton number s reached. After all the clusters and the representatve ponts are establshed, the cluster s labeled as the class that has maxmum samples wth the same communcaton pattern. 3. Host behavor descrpton ome researchers have studed the host behavor on resdental networks n the feld of traffc measurement [15][16]. The applcatons that run at the host and generate the traffc are part of the host traffc profle. The traffc profle ndcates the preferred applcatons used on the host. nce the preferred nformaton of the host s relevant to the latter applcaton, t can help wth the classfcaton of the traffc. For nstance, a host browsng the Web s more prone to open consecutve HTTP connectons. A host s very lkely to receve POP3 flows when t s runnng POP3 mal server. The dentfcaton of a flow s fve-tuple nformaton: source IP address, source port number, destnaton IP address, destnaton port number, and protocol type. The source host of a flow s the host sendng the frst packet, whle the destnaton host s the one recevng t. F s denoted as a functon that assocates a flow between a source and destnaton to an applcaton A(). (or ) s denoted as the generc source (or destnaton) host of a flow. Thus, F and F are the functons that assgn the data flow to the applcaton A and A based solely on the traffc of the PF A be source and destnaton, respectvely. Let ( ) the probablty that the flow s of an applcaton A. Then, PF ( ) A means the probablty that the flow s of an applcaton A. The followng s the computaton of the probablty that a flow s of applcaton A(). (( ) ( ( ) ) ) ( ( )) ( ) I P( F A( ) ) * P( F A( ) ) P( F A( ) I ) 1 P( F A( ) ) * P( F A( ) ) P( F A( ) ) * P( F A( ) ) P F A P F A F A A A 1 Equaton (1) needs the nformaton of each host. In general, the montor passvely captures the flows between the two hosts and can only records the traffc of one of the two hosts of a flow. Assume a unform probablty for the host that the montor has no nformaton about t, and then the equaton (1) can be smplfed to: ( ) ( ( )) ( ) P F A P F A (4) or ( ) ( ( )) ( ) P F A P F A (5) Table 3 shows the dstrbuton of applcaton n a host as source and destnaton. Tab. 3 strbuton of applcaton n a host Applcatons FTP HTTP POP3 MTP H ource estnaton Th dstrbuton of applcaton of a host s updated after a new flow of the host s classfed. The process s as follow. Let P ( ( )) n 1 A denote the probablty of A(), calculated by the past (n-1) flows. When n-th flow s collected and classfed, PF ( ( n) A ( )) s the result. Then the probablty s of A() s computed as follows. (3) 153

4 Yng Hou, Ha Huang, Wenchao hao and Heqng Huang/Journal of Engneerng cence and Technology Revew 7 (3) (2014) Pn( A( )) β* Pn 1( A( )) + (1 β)* P( Fs( n) A( )), (6) 0 β 1 β s the regulatory factors and represents the proporton of that the past dstrbuton affects Pn ( A( )). When β s set to be close to 0, most recent flows affect Pn ( A( )). When β 0, P ( ( )) n A s completely decded by current flow. When β s set to be close to 1, Pn ( A( )) s calculated by applcatons of all prevous flows. Intally, all applcatons are assgned to be unform dstrbuton. When β 0, P( A( )) s completely decded by the prevous flows. We wll dscuss β n secton 5 accordng to the experments. It should be notced that, as descrbed n equaton (7), the source and destnaton of the host are computed respectvely. P( A( ) ) β* P ( A( ) ) + (1 β)* P( F ( n) A( ) ) n n 1 s or (7) P( A( ) ) β* P ( A( ) ) + (1 β)* P( F ( n) A( ) ), n n 1 s 0 β 1 Practcally, the montor usually stores the host systems nsde the IP network and some host systems outsde the network; e.g., obvous server of some applcatons to support the classfcaton of Internet flows. The dstrbuton of the host traffc, provdes a statstcal ndcaton of the preferred applcatons that s runnng at the host. n 5. Experments and results The proposed hybrd approach was evaluated on two real data traces. The frst trace was collected from XIA unversty, named XIA trace; t was collected on fve consecutve days from the ponts connected to Internet. The second one was WIE trace [14], obtaned from a traffc data repostory mantaned by the MAWI Workng Group of the WIE Proect, whch survey and analyss the traffc of Internet backbone. We use the traffc trace collected at samplepont-f. Each packet of the traces contans 40byte payload of anonymous user nformaton that s kept prvate here. The applcatons assocated wth the traffc were determned wth a deep packet nspecton method. The traffc assocated wth fve applcatons was collected and two new traces were obtaned. Each of the traces conssts of two sets, a tranng set and a testng set. The tranng set conssts of an equal number of flows per applcaton to ensure that there s no bas n the learnng phase. The detals of the two traces are llustrated n Table 4 and Table 5. Tab.4 etal of WIE trace applcaton tranng testng HTTP ,309 FTP ,536 POP ,974 eonkey ,943 BtTorrent , Combnaton Ths secton wll ntroduce the ways of ntegraton of AP results and host behavor algorthm. P(A()) s defned as the probablty that the flow s generated by applcaton A(). The PF ( A ( )) s the probablty that a flow arrves from the applcaton A() based on ther source or destnaton host and t s calculated n Eq. (3). P (A() s the AP cluster results. s the total number of classes got from AP clusterng algorthm. The classfcaton process s performed by computng the Eucldean dstance between the feature of the new flow and the representatve ponts. Accordng to the descrptons, P(A()) s expressed by the followng formulas: PF ( A ( )) P( A ( )) PA ( ( )) (8) PF ( A ( )) P( A ( )) 1 The assgnment probablty P(A()) s calculated by combnng the result of the ntal classfcaton usng AP clusterng method, and the result of the classfcaton of the host behavor. The pattern of the hosts can be used to predct the type of applcaton for the followng traffc. The assgnment probablty P(A()) s determned by only P (A() when the applcaton s new n the host. The host applcaton dstrbuton s updated before the followng dentfcaton steps wth hybrd probablty method. The approach predcts the traffc of a host by the applcaton pattern of that host. Compared wth other technques, t s smpler because t needs not research the relatons between dfferent hosts. All of the nformaton can be easly obtaned. Tab.5 etal of XIA trace applcaton tranng testng 5.1 Metrcs HTTP ,200 FTP ,003 POP ,328 eonkey ,902 BtTorrent ,013 The metrcs used to evaluate the performance of the combnaton approach are recall, precson, and overall accuracy. For applcaton, TP s denoted as the number of flows that are correctly classfed to applcaton. FP s the number of flows that are ncorrectly classfed to applcaton. F ndcates the number of flows of applcaton that are ncorrectly classfed to other applcatons. The metrcs are gven as follows. Recall of applcaton : Precson of applcaton : F-measure of applcaton : Overall accuracy: R TP/( TP + F ) (9) P TP/( TP + FP) (10) F 2* P* R /( P + R) (11) 154

5 Yng Hou, Ha Huang, Wenchao hao and Heqng Huang/Journal of Engneerng cence and Technology Revew 7 (3) (2014) OA m 1 m 1 ( TP + FP) TP (12) are plot n Fg. 2.The dfferent lnes n the plot correspond to the overall accuracy of the method wth dfferent β. In the above metrcs, recall and precson of an applcaton ndcates the classfcaton ablty of the model to ths applcaton. The F-measure sgnfes the comprehensve classfcaton ablty of the classfer to an applcaton. The overall accuracy s gven as the weghted average over all the applcatons and shows the overall classfcaton ablty of the classfer. 5.2 Regulatory factor β and precson The performance of the classfcaton method s dscussed when the host behavor s combned wth the results computed by the statstcal method. For Trace I, Fg. 1 plot F-measure of each applcaton, when 1 to 10 packets are used to extract classfcaton features, as we dscuss n ecton 3. In the plot, dfferent lnes correspond to the overall accuracy of the combnaton approach wth dfferent β. The fgures verfy the valdty of the combnaton approach. Fg. 1(a) plot F-measure of HTTP as a functon of the packets number respectvely. wth the number of the packets ncreasng, the precson of the classfer s mproved. When β 0.9, F-measure can acheve approxmate 90% only wth two packets. Even when β 0.1, means wth a small number of host nformaton, we acqures a very hgh accuracy. Entdonkey and BtTorrent are P2P applcatons. As s known to all, for the characterstcs of P2P applcatons, P2P traffc dentcaton s very mportant for IP to manage the network. Fg. 1(d) and Fg. 1(e) demonstrate that the combnatng approach also obtans good performances n case of P2P traffc dentfcaton. Fg.2 F-measure versus the number of packets (Trace II) Trace II s collected from local area network (LA). The number of hosts n the trace s smaller than that n Trace I. Then the host nformaton plays a vtal part n the classfcaton. From Fg.2, we can notce clearly the mportance of usng the host nformaton. For example, n Fg. 2(a), when β 0.9, after four packets, F-measure exceeds 98.6% and reach 99.36% wth ten packets. In Fg.2(d) and Fg.2(e), t can be observed that wth more packets we can obtan better precson, especally wth four and more packets. Ths s clear for all values from β 0.1 to β 1 Fg. 2(c) shows that when recent flows are set more weght, most of the POP3 traffc s correctly classfed. The analyss of the traffc shows that the POP3 traffc s predomnant n some hosts. That confrms the beneft of the host nformaton. Wth all values of β, the accuracy of POP3 dentfcaton s hgh. The expermental results of overall accuracy for Trace I and Trace II, versus the number of packets of the flows, are plot n Fg. 3 and Fg. 4. The dfferent lnes n the plot correspond to the overall accuracy of the method wth dfferent β. Fg.1 F-measure versus the number of packets (Trace I) For Trace II,The expermental results of F-measure of each applcaton, versus the number of packets of the flows, Fg.3 Overall accuracy versus the number of packets (Trace I) 155

6 Yng Hou, Ha Huang, Wenchao hao and Heqng Huang/Journal of Engneerng cence and Technology Revew 7 (3) (2014) Fg.4 Overall accuracy versus the number of packets (Trace II) The regulatory factor β can be understood as the rato of the two parts of the combnaton approach. When β 1, the behavor of the host s not used, whch means each applcaton of a host has a unform probablty. The results demonstrates that the accuracy mproves consderably when the pror applcaton dstrabuton of the hosts s used to udge the applcaton of current flows. When β 0.1, the host behavor s decded by the classfcaton results of the most recent flows. When β 0.9, the classfcaton results of flows durng a long perod characterze the host behavor. The overall accuracy of Trace I s 90.42% when β 0.9 and the number of packets s 10. From the fgures, we can see that the classfer gets the best performance when β 0.9. Accordng to the above results, n the followng experments, β s set to 0.9. When β 0.5, the overall accuracy of Trace I s 86.59% wth four packets and reach 87.48% after ten packets. When β 0.9, the overall accuracy of Trace I s 89.52% wth four packets and reach 90.42% after ten packets. When β 0.9, the overall accuracy of Trace II s 98.19% wth four packets and reach 99.61% after ten packets. The ncrease of number of packets does not brng an promnent mprovement of the precson. We can conclude that wth the frst four packets of each flow to calculate the statstcal features, the classfer can get hgh precson. It s worth of payng attenton to because that means the appoach can be used n on-lne traffc classfcaton. 5.3 scusson of tranng set F-measure of Trace I and Trace II are plotted n Fg. 4 and Fg. 5 respectvely, versus the number of flows n tranng set. Fg.5 F-measure versus number of flows n tranng set (Trace I) Fg.6 F-measure versus number of flows n tranng set (Trace II) It can be seen from Fg.5 and Fg.6 that F-measure fluctuates sgnfcantly when the tranng set s smaller than 600. The performance of the classfer s better when the packets number of the tranng sets ncreases. In Trace II, the proporton of the tranng set s hgher than that of Trace I, so that a hgher precson s obtaned. When there are 1000 n the tranng set, F-measure of all fve applcatons exceeds 96% and FTP s 99.1% n Trace II. t can be concluded that the rato of tranng set and test set affects the results of classfcaton. 5.4 Comparson of algorthms Based on Trace II, the proposed algorthm was compared wth BLIC and AP algorthms. The results are shown n Fg. 7. Fg.7 Comparsons of three algorthms overall accuracy The BLIC algorthm uses host model to classfy the applcatons; whereas, AP algorthm s based on the statstc parameters. The expermental results show that the combnaton of host behavor model and the statstcal methods sgnfcantly ncreases the overall accuracy. 6. Concluson Ths paper ntroduces a traffc classfcaton algorthm that combnes AP algorthm and host behavor. Accordng to the facts that the early applcaton of host can predct the latter traffc, the host applcaton dstrbuton s establshed. Then, ths dstrbuton s combned wth the ntal results obtaned from AP algorthm. The combnaton provdes the fnal results of traffc classfc aton. The proposed method was appled on two real data traces wth very promsng results. The results demonstrate that when ncreasng the sze of tranng data, the performance of the combnaton algorthm s mproved. The comparson wth BLIC and AP algorthm ndcates that the overall accuracy of the new approach s more satsfyng than that of the other two algorthms. In addton, snce the statstcal features selected n ths paper are easy to calculate, the approach offers the prospect of onlne classfcaton. 156

7 Yng Hou, Ha Huang, Wenchao hao and Heqng Huang/Journal of Engneerng cence and Technology Revew 7 (3) (2014) Acknowledgment The correspondng author of ths paper s Ha Huang, professor of atonal gtal wtchng ystem Engneerng & Techologcal R& Center. And ths research was fnancally supported by a research grant from the atonal atural cence Foundaton of Chnese government (o ) References 1. A.Callado, C.Kamensk, et al., A urvey on Internet Traffc Identfcaton, IEEE Communcatons urvey & tutorals, 11(3), 2009, pp A. Moore, K. Papagannak, Toward the accurate dentfcaton of network applcatons, Proceedngs of Passve and Actve Measurement, Boston, UA, 2005, pp T.T.T. guyen, G. Armtage, A urvey of Technques for Internet Traffc Classfcaton Usng Machne Learnng, IEEE Communcatons urvey & tutorals,10(4), 2008, pp M.Crott, M.us, F.Grngol, L.algarell, Traffc classfcaton through smple statstcal fngerprntng, ACM-gcomm Computer Communcaton Revew, 37(1), 2007, pp M. Jaber, C. Barakat, Enhancng applcaton dentfcaton by means of sequental testng, Proceedngs of 8th nternatonal IFIP-TC 6 etworkng Conference, Aachen, Germany, 2009, pp A. Mcgregor, M. Hall, P. Lorer, J. Brunskll, Flow clusterng usng machne learnng technques, Proceedngs of Passve and Actve Measurements, Antbes Juan-les-Pns, FRACE, 2004, pp T. Karaganns, K. Papagannak, M. Faloutsos, BLIC: Multlevel Traffc Classfcaton n the ark, Proceedngs of ACM IGCOMM, Phladelpha, UA, 2005, pp A. anott, A. Pescape, K. C. Claffy. Issues and Future rectons n Traffc Classfcaton, IEEE etwork, 26(1),2012,pp G. Aceto, A. anott, W. e onato, P. Antono, PortLoad: Takng the Best of Two Worlds n Traffc Classfcaton, Proceedngs of IEEE IFOCOM, an ego, UA, 2010, pp B. J. Frey,. ueck, Clusterng by Passng Messages between ata Ponts, cence, 315(5814), 2007,pp H.L.ZHAG, G. Lu, Machne Learnng Algorthms for Classfyng the Imbalanced Protocol Flows: Evaluaton and Comparson.Journal of oftware,23(6), 2012,pp Z. Yang, L.Z. L, etwork traffc classfcaton usng decson tree based on mnmum partton dstance, Journal on Communcaton, 33(3) 2012,pp the MAWI Workng Group of the WIE Proect. MAWI Workng Group Traffc Archve; Retreved June 3, 2014, from: M. Ilofotou, B. Gallagher, T. Elass-Rad, G. Xe, M. Faloutsos, Proflng-by-assocaton: a reslent traffc proflng soluton for the Internet backbone, Proceedngs of ACM CoEXT, Phladelpha, UA, M. Petrzyk, L. Plssonneau, G. Urvoy-Keller, T. En-aary, On proflng resdental customers, Proceedngs of 3rd IEEE Internatonal Traffc Montorng and Analyss Workshop, Venna, Austra, 2011, pp