Application-based feature selection for Internet traffic classification

Recently, several statistical techniques using flow features have been proposed to address the problem of traffic classification. These methods achieve in general high recognition rates of the dominant applications and more random results for less popular ones. This stems from the selection process of the flow features, used as inputs of the statistical algorithm, which is biased toward those dominant applications. As a consequence, existing methods are difficult to adapt to the changing needs of network administrators that might want to quickly identify dominant applications like p2p or HTTP based applications or to zoom on specific less popular (in terms of bytes or flows) applications on a given site, which could be HTTP streaming or Gnutella for instance. We propose a new approach, aimed to address the above mentioned issues, based on logistic regression. Our technique can automatically select distinct, per-application features that best separate each application from the rest of the traffic. In addition, it has a low computation cost and needs only to inspect the first few packets of a flow to classify it, which means that it can be implemented in real time. We exemplify our method using two recent traces collected on two ADSL platforms of a large ISP.