Online traffic classification based on few sampled packets

Online traffic classification plays an important role in network management such as network security, accounting and provisioning. Traffic classification based on the first few packets (CFFP) reflects great promising prospective. However, not all flows can be observed the needed packets, especially in high-speed network. In this paper, classification based on arbitrary conjoint few packets (CACFP) and classification based on arbitrary disjunctive few packets of a flow (CADFP) are proposed. Meanwhile, classification based on entire packets of a flow (CEP) and classification based on the first few packets (CFFP) is used as baseline. First, mutual information of features with applications are analyzed under above four methods. Then, a real-time trace is used to validate our assumption. Experimental results show that CACFP and CADFP can obtain similar mutual information and classification accuracy with CFFP, which are also suitable for online traffic classification and make it possible for deploying practical online traffic classification system.