# A Real-Time Network Traffic Classifier for Online Applications Using Machine Learning
## 5 Experimental Evaluation
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Class** & **Precision** & **Recall** & **F1-Score** & **Support** \\ \hline AMAZON & 0.95 & 0.95 & 0.95 & 2958 \\ \hline APPLE & 0.92 & 0.91 & 0.92 & 2977 \\ \hline APPLE\_JCLOUD & 0.97 & 0.99 & 0.98 & 2950 \\ \hline APPLE\_ITUNES & 0.96 & 0.97 & 0.96 & 3062 \\ \hline CITRIX\_ONLINE & 1.00 & 1.00 & 1.00 & 11 \\ \hline CLOUDFLARE & 0.98 & 0.98 & 0.98 & 3046 \\ \hline CONTENT\_FLASH & 1.00 & 0.99 & 0.99 & 2950 \\ \hline DEZZER & 1.00 & 0.33 & 0.50 & 18 \\ \hline DNS & 1.00 & 1.00 & 1.00 & 2990 \\ \hline DROPBOX & 0.90 & 0.87 & 0.89 & 3028 \\ \hline EASYTAXI & 0.97 & 0.99 & 0.98 & 3083 \\ \hline EBAY & 0.97 & 0.98 & 0.98 & 3025 \\ \hline EDONKEY & 1.00 & 0.67 & 0.80 & 27 \\ \hline FACEBOOK & 0.93 & 0.94 & 0.94 & 2932 \\ \hline FTP\_CONTROL & 0.78 & 0.78 & 0.78 & 9 \\ \hline FIT\_DATA & 0.99 & 1.00 & 0.99 & 3008 \\ \hline GMAIL & 0.84 & 0.84 & 0.84 & 2966 \\ \hline GOOGLE & 0.95 & 0.99 & 0.97 & 2948 \\ \hline GOOGLE\_MAPS & 0.97 & 0.97 & 0.97 & 3014 \\ \hline H323 & 0.00 & 0.00 & 0.00 & 7 \\ \hline HTTP & 1.00 & 1.00 & 1.00 & 3010 \\ \hline HTTP\_CONNECT & 0.98 & 1.00 & 0.99 & 3064 \\ \hline HTTP\_DOWNLOAD & 0.99 & 0.99 & 0.99 & 3010 \\ \hline HTTP\_PROXY & 0.96 & 0.99 & 0.98 & 2958 \\ \hline INSTAGRAM & 0.98 & 0.96 & 0.97 & 3164 \\ \hline IP\_ICMP & 1.00 & 1.00 & 1.00 & 3010 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: The precision, recall and F1-score of the RF model. The precision ratio describes the performance of our model at predicting the positive class. It is calculated by dividing the number of true positives by the sum of the true positives and false positives, as follows:  
\[Precision=\frac{TruePositives}{TruePositives+FalsePositives} \tag{13}\]  
The recall ratio is calculated as the ratio of the number of true positives divided by the sum of the true positives and the false negatives, as follows:  
\[Recall=\frac{TruePositives}{TruePositives+FalseNegatives} \tag{14}\]  
F1-score ratio is calculated by a weighted average of both precision and recall, as follows:  
\[F1-score=2*\frac{Precision*Recall}{Precision+Recall} \tag{15}\] \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Class** & **Precision** & **Recall** & **F1-Score** & **Support** \\ \hline MICROSOFT & 0.95 & 0.97 & 0.96 & 2928 \\ \hline MQTT & 1.00 & 1.00 & 1.00 & 3042 \\ \hline MSN & 0.94 & 0.93 & 0.93 & 3016 \\ \hline MS\_ONE\_DRIVE & 1.00 & 0.99 & 0.99 & 2979 \\ \hline NEITLX & 0.96 & 0.96 & 0.96 & 2967 \\ \hline NTP & 1.00 & 1.00 & 1.00 & 2977 \\ \hline OFFICE\_365 & 0.98 & 0.97 & 0.98 & 2879 \\ \hline SKYPE & 0.88 & 0.87 & 0.88 & 2913 \\ \hline SPOTIFY & 0.98 & 0.96 & 0.97 & 3025 \\ \hline SSH & 1.00 & 1.00 & 1.00 & 2990 \\ \hline SSL & 0.93 & 0.95 & 0.94 & 2990 \\ \hline SSL\_NO\_CERT & 0.99 & 0.99 & 0.99 & 2988 \\ \hline TEAMVIEWER & 1.00 & 1.00 & 1.00 & 3039 \\ \hline TELEGRAM & 1.00 & 0.82 & 0.90 & 11 \\ \hline TIMMEU & 0.75 & 0.27 & 0.40 & 11 \\ \hline TOR & 0.98 & 0.99 & 0.98 & 3002 \\ \hline TWITCH & 0.00 & 0.00 & 0.00 & 7 \\ \hline TWITTER & 0.84 & 0.82 & 0.83 & 2994 \\ \hline UBUNTUONE & 0.99 & 1.00 & 1.00 & 2937 \\ \hline JABBER & 0.91 & 0.83 & 0.87 & 12 \\ \hline UPNP & 1.00 & 0.83 & 0.91 & 12 \\ \hline WAZE & 0.94 & 0.74 & 0.83 & 23 \\ \hline WHATSAPP & 0.95 & 0.90 & 0.92 & 3038 \\ \hline WIKIPEDIA & 0.97 & 0.95 & 0.96 & 3087 \\ \hline MS\_UPDATE & 0.95 & 0.94 & 0.94 & 3080 \\ \hline YAHOO & 0.91 & 0.86 & 0.89 & 2931 \\ \hline YOUTUBE & 0.89 & 0.96 & 0.92 & 3048 \\ \hline Macro Average & 0.92 & 0.88 & 0.89 & 126,151 \\ \hline Weighted Average & 0.96 & 0.96 & 0.96 & 126,151 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: _Cont._We also observed that our model delivers good results even when flow packets are captures directly from NIC in real time. Figure 9 shows a snapshot of the classification report of the RF model on the web-based GUI. The figure shows that traffic flows from 12 different online applications are captured and predicted using the RF model. Furthermore, our GUI shows the precision, recall, and F1-score ratios of these live streams.