Search Swinburne Research Bank
Home List of Titles A preliminary performance comparison of five machine learning algorithms for practical IP traffic flow classification
Please use this identifier to cite or link to this item: http://hdl.handle.net/1959.3/5509
- A preliminary performance comparison of five machine learning algorithms for practical IP traffic flow classification
- Williams, Nigel; Zander, Sebastian; Armitage, Grenville J.
- The identification of network applications through observation of associated packet traffic flows is vital to the areas of network management and surveillance. Currently popular methods such as port number and payload-based identification exhibit a number of shortfalls. An alternative is to use machine learning (ML) techniques and identify network applications based on per-flow statistics, derived from payload-independent features such as packet length and inter-arrival time distributions. The performance impact of feature set reduction, using Consistency-based and Correlation-based feature selection, is demonstrated on Naive Bayes, C4.5, Bayesian Network and Naive Bayes Tree algorithms. We then show that it is useful to differentiate algorithms based on computational performance rather than classification accuracy alone, as although classification accuracy between the algorithms is similar, computational performance can differ significantly.
- Publication type
- Journal article
- Research centre
- Swinburne University of Technology. Faculty of Information and Communication Technologies. Centre for Advanced Internet Architectures
- Computer Communications Review, Vol. 36, no. 5 (2006), pp. 7-15
- Publication year
- Machine learning; Traffic classification
- Association for Computing Machinery
- Publisher URL
- Peer reviewed