Designing a Robust Network Traffic Annotator and Classifier Using Active Learning Technique

Network Traffic analysis in Enterprise networks have gained importance due to its wide application from Network resource planning to other applications such as anomaly detection. Recent communication networks transfer all data on an end to-end encrypted network for enhancing privacy preservation among user data and to provide secure data communication. This end-to-end setup makes the traffic analysis harder for network analysts and administrators. Anomaly detection in networks using Machine learning is a challenging issue since labeled dataset supported with ground truth to classify the network traffic is not publicly available. Traditional learning approaches require a labeled dataset for traffic classification which is very difficult in nature since data is represented in raw format and needs efficient labeling techniques. To pre-process the network capture f iles such as pcap files require manual inspection and to label the pcap as malicious or benign, features from pcap need to be extracted manually. In this paper, a robust network traffic classifier is proposed which makes use of Pool-based Active Learning technique to label the raw data using features obtained from pcap files. Use of Supervised learning model on these labeled data sets helps to classify the mixed type traffic as malicious or benign traffic. The results show that a combination of Active Learning and Supervised learning model can efficiently classify the unknown traffic representations.