A Comparative Study of Unsupervised Learning Techniques and Natural Language Processing in Network Traffic Classification

In order to achieve the best utilization of resources, contemporary methods aimed at enhancing the categorization of network traffic for optimal prioritization often depend on port identification and deep packet inspection (DPI). However, these techniques have become outdated due to the unpredictable assignment of ports to new applications and the existence of concealed traffic. Modern techniques leveraging machine learning and deep learning extract numerous features from networks and subsequently produce offline analyses. Unfortunately, the results of these approaches lead to substantial computational burdens. Consequently, the utilization of labeled datasets containing network-specific attributes has been adopted, but these datasets remain limited in availability. Additionally, the models developed using such network-centric findings tend to be inherently network-centric themselves.In this paper, network-independent data-centric models on payloads and payloads with headers have been built by performing network traffic classification with a comparison of the efficacy of KMeans, DBSCAN, and NLP approaches (by leveraging topic modeling). The optimum and best number of clusters were obtained for topic modelling, with the best topic coherence score of 0.8069 for the payload with header and 0.8000 for only the payload. Our results show that the topic model obtains the optimal number of clusters and produces better results than KMeans and DBSCAN. This optimal number of clusters allows for a simple method of detecting abnormal traffic. Our study could potentially create avenues to address the scarcity of labeled data in this specific research domain.