# Traffic Classification in Software-Defined Networking Using Genetic Programming Tools
## 2 Material and Methods
### Theoretical Framework
#### 2.1.2 Network Traffic Classification  
The wide variety of network applications introduces a large amount of data into present-day networks. Thus, traffic classification is considered essential for efficient network management, the implementation of appropriate QoS, and security mechanisms. However, effective network traffic classification is a difficult task. To distinguish packet-s/flows into categories, some common characteristics of packets or flows related to port, payload, correlation, behavior, and statistics are considered. All the required information is collected either from packet headers, from the packets' payload, or from the OpenFlow switches' statistics [16]. A brief description of each technique follows.  
Port-based: This technique has been used successfully in the past by exploiting the port numbers provided by the Internet-Assigned Numbers Authority (IANA) for specific applications and protocols. Of course, these techniques are nowadays considered obsolete and inaccurate as most applications communicate via ephemeral (dynamic) ports or over HTTP/HTTPS (e.g., peer-to-peer apps) [17].  
Deep Packet Inspection (DPI): The DPI method maps the content of packets (payload) to a signature, or specific patterns based on the application from which they originate. A DPI classifier examines the payload portion and matches it with a set of stored patterns to classify applications. It is based on four degrees of verification related to signature, syntax, protocol, and semantics. It was demonstrated that it achieves high levels of accuracy, completeness, and convergence. The main problems with the method are the inability to scale, the high cost, the increased complexity, the inability to apply to encrypted traffic, and emerging privacy issues. There is also a requirement to continuously update stored signatures or templates to include new application templates [18].  
Statistical-based classification: Unlike other approaches, statistical-based classification relies on statistical features extracted from packets or traffic flows of network data in combination with machine learning methods. The extracted features, such as packet duration, packet length, time between consecutive arrivals, flow duration time, and flow idle time, are considered unique for each traffic type and are used as inputs to the ML models that decide  
Figure 1: The typical architecture of SDN.  
the classification. This classification approach achieves high accuracy but requires a lot of time to process the data. In general, the performance of these techniques depends largely on the quality of the collected features [10].  
Behavioral classification: In this approach, the point of observation is the end-host, and using appropriate tools, the entire traffic received by it is examined to detect the type of application or protocol running on the target endpoint [19]. This method is also based on the collection of statistics from traffic. The information, such as the distribution of packet sizes, the time between successive packet arrivals, etc., is used to identify the application generating the data. This technique does not need to examine the payload or the encrypted data, but it requires a large number of samples to achieve high accuracy.