## 4 Validation and Implementation Results  
The proposed HOC was tested by identifying the traffic on three different applications: WhatsApp, Twitter and http. All the datasets of these were collected from the campus environment (Umm Al-Qura University, Computing College at AlQunfudah). WhatsApp has provided end-to-end encryption by default so messages can be seen only by the sender and recipient, and no one in between. Wireshark software [33] was used to capture and analyze this traffic. The captured file contains a large number of packets, carrying information and data about the captured application. During the capture process, the traffic needed was generated and captured manually. This means all the other Internet traffic was prevented from generating traffic. Even the windows and application updates were closed.  
In ML classifier, the Weka open source was used as a machine learning tool in the training stage. The CSV file, prepared in the capturing step, was used to prepare the Weka file. Based on the previous steps, the rules of the PART algorithm (Weka algorithm) were copied and saved. These rules were prepared to be used by MATLAB, which is involved in if else statements.  
Table 4 illustrates the number of packet flows which were used in the training and testing stage for each of the considered application.  
As mentioned before, the hybrid online classifier (HOC) makes decisions based on the decisions of both the ML and port classifiers.  
The rules generated by the PART algorithm were used by HOC. Figure 5 illustrates the results of the Twitter traffic classification. The figure shows the accuracy of the proposed HOC compared to ML and port classifiers. As seen, the HC and ML classifier provided high accuracy (72.5%) compared to the port classifier (0%).  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Application** & **Number of Training Flows** & **Number of Testing Flows** \\ \hline http & 1500 & 750 \\ \hline WhatsApp & 1500 & 750 \\ \hline Twitter & 1500 & 750 \\ \hline \hline \end{tabular}
\end{table}
Table 4: Number of flows in training and testing stages.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**HOC Priorities Order** & **Port Classifier** & **ML Classifier** \\ \hline
1. Unknown & \(\times\) & \(\times\) \\ \hline
2. Port or Statistic classifier (class A) & (class A) & (class A) \\ \hline
3. Statistic classifier (class B) & (class A) & (class B) \\ \hline
4. Port classifier (class A) & (class A) & \(\times\) \\ \hline \hline \end{tabular}
\end{table}
Table 3: HOC priority rules order.  
The testing data of http traffic was classified by the hybrid classifier. Figure 6 shows the results of http traffic classification. As shown in the figure, the hybrid classifier has a high classification accuracy (90.13%) compared to ML (84.8%) and port classifier (55.73%).  
In the same way, the testing data of the WhatsApp traffic was classified by the proposed HC. Figure 7 shows the WhatsApp traffic classification results. As shown, the hybrid classifier generates a high accuracy (88.79%) when compared with the other two classifiers (85.05% and 37.9%).  
Figure 5: Twitter traffic classification results.  
Figure 6: Http traffic classification results.