Performance Comparison of Different Feature Sets for Network Traffic Classification using Recursive Feature Elimination and One-Vs-Rest Random Forest Algorithms

Network traffic classification is an identification process of network applications like Yahoo, YouTube, Facebook, and Skype. Network traffic classification is required by network management to manage resources and to know different applications that can help network operators provide good Quality of Service, secure network, and monitor network. In this paper, we focused on the 7th layer of OSI model and using only TCP data. In recent years, there is much machine learning research to solve this problem either using supervised, unsupervised, or deep learning. Different feature sets are used to find the best performance for network traffic classification using Recursive Feature Elimination feature selections and One-Vs-Rest Random Forest classifiers. Six sets are compared: flow-based, session-based, time-based, packet-based, flow+ session-based, and packet+time-based. Furthermore, we have class imbalance problems in multiclass that make this difficult due to imbalance distribution, presence of outliers, and irrelevant features. Using this method, we can solve these problems. From the experiment, we get flow-based as the best feature set for network traffic classification with f1-score 0.81, GM 0.85, and model build time is 2634.987 s. Actually, we also can use packet-based, flow+session-based, and packet+time-based with a good classifier but need more time to model build.