Designing an accurate and efficient classification approach for network traffic monitoring
Creators: name: Al-Harthi, Adil
Publisher: name: RMIT University
Year: 2024

description: In recent years, knowing what information is passing through the networks is rapidly becoming more and more complex due to the ever-growing list of applications shaping today's Internet traffic. Consequently, traffic monitoring and analysis have become crucial for tasks ranging from intrusion detection, traffic engineering to capacity planning. Network Traffic Classification is the process of analysing the nature of the traffic flows on the networks, and classifies these flows mainly on the basis of protocols (e.g. TCP, UDP, IMAP etc.) or by different classes of applications (e.g. HTTP, P2P, Games etc.). Network Traffic Classification has the capability to address fundamentals to numerous network management activities for Internet Service Providers (ISPs) and their equipment vendors for better Quality of Service (QoS) treatment. In particular, network operators need an accurate and efficient classification of traffic for effective network planning and design, applications prioritization, traffic shaping/policing and security control. It is essential that network operators understand the trends in their networks so that they can react quickly to support their business goals. Traffic classification can also be a part of Intrusion Detection Systems (IDS) where the main goal of such systems is to detect a wide range of unusual or anomalous events, and to block unwanted traffic. In this thesis, we have investigated several key issues related to the problem of accurate and effective network traffic classification. We were particularly motivated by the specific problems associated with network traffic classification based on machine learning and Transport Layer Statistics (TLS). Most past research has applied different categories of machine learning, including: supervised learning and unsupervised learning algorithms on the TLS of the traffic data to address the problem of network traffic analysis. Significant recent research has revealed that TLS data allows the machine learning classification-based techniques to rely on sufficient information. In light of these findings, we focused our efforts on the modelling and improvement of network traffic classification based on the concept of machine learning and TLS data. This thesis is concerned with improving the accuracy and the efficiency of network traffic classification. Four research issues are being addressed to achieve the main aim of this thesis. The first research task is to optimize various feature selection techniques for improving the quality of the Transport Layer Statistics (TLS) data. The second research is intended to identify the optimal and stable feature set in the temporal-domain and the spatial-domain networks. The third research task is related to the development of preserving the privacy framework to help network collaborators in the spatial-domain network to publish their traffic data and making them publicly available. The final research task is related to automatically provide sufficient labelled traffic flows for constructing a traffic classification model with good generalization ability, and to evaluate the generated traffic classification.<br>