Divide-and-Conquer Based Traffic Classification: Towards A Cascaded Classifier

With the rapid development of the Internet and mobile applications, traffic classification plays an increasingly crucial role in network management. Traditional traffic classification methods have limitations as they rely on pre-defined features, and technologies in modern applications, such as HTTPS and content delivery networks (CDN), which may reduce their classification accuracy. Deep learning based methods can capture higher-level features, but overly complex models can lead to higher computational complexity and affect generalization performance. In this paper, we propose RFT-ACG, a method using a cascaded classifier to classify encrypted application traffic. Generally, the majority of encrypted flows can be simply classified using only the feature of primary session. Such flows are referred to as “simple flows”, while the rest of encrypted flows which require complicated session features of multi-party interactions to achieve accurate traffic classification, are referred to as “complex flows”. Given traffic blocks generated by applications, a divide-and-conquer method is first exploited to determine whether they are simple or complex flows. As to a simple flow, it is directly classified using simple machine learning methods; otherwise, the complex flow is handed over to more complex learning methods for further processing. Our experimental results indicate that compared to the recently proposed methods, RFT-ACG can classify most of the network traffic in the first stage, effectively reducing the proportion of network traffic that needs to be classified by constructing complex traffic interaction graphs, while achieving an accuracy improvement of approximately $4 \%$.