From n to n+x: A Novel Open World Traffic Classification Framework Based on Multiple Classifiers Ensemble

Application-level traffic classification is a critical component in network management and security. In recent years, intelligent classification methods have been proven effective, especially for encrypted network traffic. However, these methods face several limitations in real networks, such as a lack of interpretability and inefficiency of complex models. More importantly, they seldom consider unknown applications and only identify them as unknown. This paper proposes a novel traffic classification framework named APPrint, which identifies the traffic of trained applications but can also differentiate flows generated from diverse unknown applications. The core of APPrint is to trade off recognition accuracy for enhanced generalization capability. By integrating the results of multiple high-accuracy classifiers, APPrint effectively addresses the n+x classification problem using n known applications. Through comparative experiments with two State-of-the-Art(SOTA) solutions, APPprint demonstrates a significant accuracy advantage when there are a large number of unknown applications. Additionally, unlike existing solutions that only perform n+1 classification using n known applications, APPrint is capable of classifying unknown applications, achieving n+x classification.