## 2 Related Works
### Online Classification Related Works  
There are many published articles which include the term \"online classification\" in the title [7]. Unfortunately, most of them have no actual online classification but only real traffic classification (non-live). The following paragraphs discuss some related works, which mostly includes the words \"online classification\" in their titles.  
The study [21] proposed a hybrid traffic classification (HTC) method based on machine learning and combined with IP/ASN analysis. The packets with the same IP and port number were treated as same flow. When the packet comes in, it will check whether the flow has been classified first. After that it will find the classification result and mark the differentiated services code point (DSCP). If the flow is not classified by the first stage (encrypted flow), the proposed model is used and the second stage classification are performed. The flow classification was continuous until reaches k times. Then the majority voting method is used for calculation according to the classification results. The cooperative between IP/ASN (Autonomous System Number) and the proposed model increase the classification accuracy by 10%.  
In order to maintain the accuracy of ML classifier the researchers [22] proposed a retraining mechanism. The accuracy of ML classifier is checked from time to time based on some flows which were labeled by the heuristic training dataset. The mechanism was divided into three stages. In the first stage, flows were extracted from incoming packets by the offline training dataset generator. In the second stage, the accuracy of ML classifier was evaluated against the accuracy generated by the training dataset generator. In the last stage, the online ML classifier was updated in case the current ML accuracy is below a predefined threshold.  
Based on the analysis of the previous studies of hybrid classifiers, four limitations are observed: first, the proposed hybrid classifier may not consider the classification time as complexity factor. Second, most of the previous hybrid classifiers did not consider the online classification. Third, the hybrid classifiers are based on hardware components such as network processors which carry additional costs. Last, the stages of the hybrid classifier may build based only on one classification method. Table 1 summarizes some hybrid classifiers proposed by previous studies. The answer \"yes\" means the work considered the issue, whilst the answer \"no\" means the work did not consider the issue.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Works**} & \multirow{2}{*}{**Hybrid Classifier Stages**} & **Does the Work** & **Does the Hybrid** & **Does the Classifier** \\  & & **Considers or** & **Classifier Consider** & **Did Not Builds Based** \\  & & **Discusses the** & **Online Classification?** & **on Any Hardware** \\  & & **Complexity?** & **Components?** \\ \hline \multirow{2}{*}{[1]} & Three steps classifier: min-max & & & \\  & method, random forest, and Support & yes & no & yes \\  & Vector Machine (SVM) & & & \\ \hline \multirow{2}{*}{[23]} & A hybrid Radial Basis Function & no & no & yes \\  & Network (RBFN) & & & \\ \hline \multirow{2}{*}{[19]} & Two stages (signatures-based and & & \\  & statistical procedures) & no & no & yes \\ \hline \multirow{2}{*}{[7]} & Three stages (port-based, deep packet & & \\  & inspection-based, and & no & no & yes \\  & statistical-based) & & & \\ \hline \multirow{2}{*}{[17]} & Hybrid classifier used header and & & & \\  & payload information & no & no & yes \\ \hline \multirow{2}{*}{[21]} & Hybrid classifier with two stages: & & & \\  & IP/ASN analysis and proposed model & no & yes & yes \\ \hline \multirow{2}{*}{[24]} & Two-stage traffic classification for P2P & & & \\  & traffic: filtering mechanism and & no & no & yes \\ \hline \multirow{2}{*}{[25]} & Three stages (port-based, static & & \\  & payload signatures, DPI) & no & no & yes \\ \hline \hline \end{tabular}
\end{table}
Table 1: Some of hybrid classifier in researcher works.