# Results and Achievements of the ALLIANCE Project: New Network Solutions for 5G and Beyond
## 4 Monitoring Element
### Implementation and Evaluation of the Proposed Monitoring Platform  
The monitoring platform proposed in [35] keeps updated traffic measurements in a distributed manner in the switches, while devices send asynchronously summaries of these measurements to the control plane. Moreover, we have proposed a novel classification system on top of the previous measurement system to identify the applications that generate traffic in the network. Presently, it is more and more common to find very diverse applications specifically under web-based services and encrypted traffic (e.g., VoIP, cloud storage, video streaming), which may have very different networking requirements (e.g., low delay, high bandwidth). This makes it particularly interesting to identify the applications generating traffic under this type of traffic (e.g., HTTP, HTTPS, SSL/TLS). In this context, the proposed classification system combines ML and DPI techniques, with special attention to the identification of applications that generate web and encrypted traffic [37]. In particular, this system first uses a decision tree-based classifier (c5.0 decision tree [38]) to discover the application-level protocol of traffic flows (e.g., HTTP, HTTPS, SSH, SMTP, DNS), and then applies more specific DPI techniques on web and encrypted flows to identify the application names within this type of traffic (e.g., Netflix, YouTube, Dropbox). Please note that these latter DPI techniques--that leverage functionalities from the open-source nDPI [39] and Bro IDS [40] tools--are applied only over the first few packets of web and encrypted flows. In particular, they use information at the beginning of HTTP sessions (e.g., from the HTTP GET header) and the initial handshakes of SSL/TLS connections (Server Name Indication field in certificates), thus incurring in limited processing overhead for the proposed monitoring platform.  
We have implemented a prototype of this network-monitoring platform in the Open-Daylight controller [41]--which is well known in the SDN domain--and evaluated this prototype in a test environment with Open vSwitch [42]. Our evaluation results, using real traffic from three different networks, show that the proposed system achieves good accuracy levels for both measuring and classifying traffic; while maintaining a reasonable execution cost. As an example, Table 1 shows the accuracy achieved by the proposed classification system over several well-known web-based applications. These results were obtained through experiments with real-world traffic from a 10 Gbps access link of a large Spanish university network [37]. Applications are identified by their domain names, extracted either from HTTP headers or SSL/TLS certificates at the beginning of connections (packets transmitted during the first 40 ms of web and encrypted flows). We refer the reader to [35; 37] for a detailed analysis on the tradeoff between accuracy and cost in the proposed monitoring platform. Finally, our prototype was integrated with a commercial network visibility platform to showcase its usefulness in a practical demonstration using real-world traffic [43].