A Preliminary Performance Comparison of Five Machine Learning Algorithms for Practical IP Traffic Flow Classification

@article{citeulike:1507162, abstract = {The identification of network applications through observation of associated packet traffic flows is vital to the areas of network management and surveillance. Currently popular methods such as port number and payload-based identification exhibit a number of shortfalls. An alternative is to use machine learning (ML) techniques and identify network applications based on per-flow statistics, derived from payload-independent features such as packet length and inter-arrival time distributions. The performance impact of feature set reduction, using Consistency-based and Correlation-based feature selection, is demonstrated on Na\"{i}ve Bayes, C4.5, Bayesian Network and Na\"{i}ve Bayes Tree algorithms. We then show that it is useful to differentiate algorithms based on computational performance rather than classification accuracy alone, as although classification accuracy between the algorithms is similar, computational performance can differ significantly.}, author = {Williams, Nigel and Zander, Sebastian and Armitage, Grenville }, citeulike-article-id = {1507162}, journal = {ACM SIGCOMM Computer Communication Review}, keywords = {behaviors-detection, learning, legacy-application, network}, month = {October}, number = {5}, posted-at = {2007-07-27 14:51:46}, priority = {5}, title = {A Preliminary Performance Comparison of Five Machine Learning Algorithms for Practical IP Traffic Flow Classification}, url = {http://www.sigcomm.org/ccr/drupal/?q=node/62}, volume = {36}, year = {2006} }

TY - JOUR ID - citeulike:1507162 L3 - citeulike-article-id:1507162 TI - A Preliminary Performance Comparison of Five Machine Learning Algorithms for Practical IP Traffic Flow Classification JF - ACM SIGCOMM Computer Communication Review VL - 36 IS - 5 N2 - The identification of network applications through observation of associated packet traffic flows is vital to the areas of network management and surveillance. Currently popular methods such as port number and payload-based identification exhibit a number of shortfalls. An alternative is to use machine learning (ML) techniques and identify network applications based on per-flow statistics, derived from payload-independent features such as packet length and inter-arrival time distributions. The performance impact of feature set reduction, using Consistency-based and Correlation-based feature selection, is demonstrated on Naïve Bayes, C4.5, Bayesian Network and Naïve Bayes Tree algorithms. We then show that it is useful to differentiate algorithms based on computational performance rather than classification accuracy alone, as although classification accuracy between the algorithms is similar, computational performance can differ significantly. KW - behaviors-detection KW - learning KW - legacy-application KW - network AU - Williams, Nigel AU - Zander, Sebastian AU - Armitage, Grenville PY - 2006/10// UR - http://www.sigcomm.org/ccr/drupal/?q=node/62 ER -