## 1 Introduction
### Classification Methods  
The port-based classification method is based on the 16-bit port numbers on the transport layer, which consist of the information on source and destination ports. Put simply, the classifier uses these port numbers to determine the application classes. In other words, the classifier reads the port number from the Internet Assigned Numbers Authority (IANA) and then uses this number to distinguish between the Internet application types. The port-based classification method has the following advantages: (i) it is very simple, (ii) it can be used to limit worm traffic, (iii) it is very fast, (iv) it can be applied by all routers and layer three switches, and (v) it is efficient in classifying protocols carried by a fixed port number [2]. However, this method is not sufficient to classify the new Internet applications that use unknown-port numbers [3; 4; 5]. Payload-based classification or Deep Packet Inspection (DPI) is an individual packet inspection looking for unique signatures. This means that the packets will be investigated one by one to find a unique signature. This helps in establishing that the packet belongs to a particular class (application). According to researchers [6; 7; 8], payload-based classification methods overcome the port number dependency problem and achieve higher accuracy. This is generically due to the fact that the unique signature (if it exists) always tells the truth, hiding nothing. The type of signature used in the classification of traffic is based on the Internet application type and can be found in applications or transport layers. The classifier can use the signature in text (string) or hexadecimal (HEX) formats. The classifier uses these signatures to decide which packet/flow belongs to which application. Another method is machine learning (ML)-based or flow statistical-based and it uses a collection of information to classify the network traffic. The main advantage of this approach is that it can be used at any point in the network [2]. Unlike port and payload-based methods, which are based on specific port numbers and unique signatures, the statistical-based method can identify the traffic based only on statistical features calculated from network flows. Machine learning (ML) is the most common technique used for statistical-based classification. Machine learning is one of the modern application classification techniques, which uses Artificial Intelligence to identify IP traffic. Machine learning overcomes the limitations of payload-based technique [9]. Moreover, some of ML algorithms such as Support vector machines (SVM) are suitable for detecting non-Tor traffic [10]. The ML technique is performed in several steps; firstly, selection of a dataset which contains all or some of the feature values. These features are attributes of traffic flow, such as packet length, inter arrival time, protocol, idle time and other such attributes. Second comes the application of the training stage for ML to establish classification rules; this is based on statistical computation extracted from the features. Finally, ML classification is applied to unknown packets using the training rules from the second step. Due to the rapid nature of real time applications, an important issue that must be considered when classifying Internet applications is the time of collecting the statistical values (to build the rules), which is assumed to be very short. ML consists of different algorithms categorized into two main types, supervised learning and unsupervised learning. Another method of classification is to use a hybrid. A hybrid network classifier is defined as a classifier which uses more than one classification method. Port-based, payload-based, statistical-based and hardware-based are the common methods that are used in building hybrid classifiers. Each of the classification methods has some advantages as well as some limitations. The hybrid multistage classifier makes full use of the advantages of each of the partial methods [7].