A Real-Time Network Traffic Classifier for Online Applications Using Machine Learning
A Real-Time Network Traffic Classifier for Online Applications Using Machine Learning
复制标题
DOI：
10.3390/a14080250
复制
发表时间：
2021-08-01
期刊：
影响因子：
2.3
通讯作者：
Agunsoye, Gbenga
中科院分区：
文献类型：
--
作者：
Ahmed, Ahmed Abdelmoamen;Agunsoye, Gbenga
网络流量的日益普遍和新的在线应用程序的部署增加了流量分析的复杂性。传统上，网络管理员依赖于识别众所周知的静态端口来对其网络流量进行分类。然而，现代网络流量使用动态端口并且通过安全应用层协议（例如，HTTPS、SSL和SSH）。这使得网络管理员使用传统的基于端口的方法来识别在线应用程序成为一项具有挑战性的任务。现代网络流量分类的一种方法是使用机器学习（ML）来区分不同的流量属性，如数据包的数量和大小，数据包到达间隔时间，数据包发送-接收比等，本文介绍了NetScrapper，基于流的网络流量分类器的设计和实现的在线应用。NetScrapper使用三种机器学习模型，即K最近邻（KNN），随机森林（RF）和人工神经网络（ANN），对最流行的53个在线应用程序进行分类，包括亚马逊，YouTube，谷歌，Twitter等。我们收集了一个包含3，577，296个数据包流的网络流量数据集，这些数据包流具有不同的87个特征，用于训练、验证和测试ML模型。开发了一个基于Web的用户友好界面，使用户能够将其网络流量的快照上传到NetScrapper，或直接从网络接口卡真实的实时嗅探网络流量。此外，我们还创建了一个中间件管道，用于将这三个模型与Flask GUI连接起来。最后，我们使用各种性能指标（如分类准确性和预测时间）评估了NetScrapper。最值得注意的是，我们发现我们的ANN模型在识别我们数据集中的在线应用程序时达到了99.86%的整体分类准确率。
The increasing ubiquity of network traffic and the new online applications' deployment has increased traffic analysis complexity. Traditionally, network administrators rely on recognizing well-known static ports for classifying the traffic flowing their networks. However, modern network traffic uses dynamic ports and is transported over secure application-layer protocols (e.g., HTTPS, SSL, and SSH). This makes it a challenging task for network administrators to identify online applications using traditional port-based approaches. One way for classifying the modern network traffic is to use machine learning (ML) to distinguish between the different traffic attributes such as packet count and size, packet inter-arrival time, packet send-receive ratio, etc. This paper presents the design and implementation of NetScrapper, a flow-based network traffic classifier for online applications. NetScrapper uses three ML models, namely K-Nearest Neighbors (KNN), Random Forest (RF), and Artificial Neural Network (ANN), for classifying the most popular 53 online applications, including Amazon, Youtube, Google, Twitter, and many others. We collected a network traffic dataset containing 3,577,296 packet flows with different 87 features for training, validating, and testing the ML models. A web-based user-friendly interface is developed to enable users to either upload a snapshot of their network traffic to NetScrapper or sniff the network traffic directly from the network interface card in real time. Additionally, we created a middleware pipeline for interfacing the three models with the Flask GUI. Finally, we evaluated NetScrapper using various performance metrics such as classification accuracy and prediction time. Most notably, we found that our ANN model achieves an overall classification accuracy of 99.86% in recognizing the online applications in our dataset.