Traffic Classification with Machine Learning in a Live Network

This paper reports on our experience with deploying network traffic classifiers in a live Software Defined Network (SDN). We select five simple machine learning (ML) algorithms and implement them for Distributed Denial of Service (DDoS) detection. Using publicly available datasets, we establish a standard reference for the performance of each classifier (algorithm) in terms of accuracy, precision and detection rate. An identical experiment over a live SDN shows that the classifiers perform significantly poorer compared to the reference standard, exhibiting up to 11.2% lower accuracy, 30.2% lower precision and detection rate lower than 15% (98% in the reference standard). We argue that the interactions between network elements such as the switch and the controller significantly significantly affects the performance of ML algorithms in a live network which must be accounted for in a real deployment.