# Data-Driven Construction of User Utility Functions from Radio Connection Traces in LTE
## 4 Estimation of QoS Thresholds on a Per-Service Basis
### Step 1: Classification of Connection Traces  
Due to the coexistence of multiple services with very different requirements, cellular operators are forced to classify traffic for each service to offer differentiated access and resource management [32]. In LTE, services are distinguished by their QCI value [33]. Then, different traffic management priorities and policies (e.g., scheduling weights, queue thresholds, link-layer protocol configuration, etc.) are applied depending on QCI. In current networks, services are commonly classified as QCI 1 (VoIP), QCI 2 (conversational video), QCI 3 (real-time gaming), QCI 4 (non-conversational video), QCI 5 (IMS signaling) and QCIs from 6 to 9 (services based on the Transport Control Protocol without a guaranteed bit rate) [33]. In particular, QCI labels 6 to 9 include a mix of services, ranging from social networks to buffered streaming, which have very different QoS requirements from a QoE perspective. Moreover, some operators assign these last QCI values for user prioritization purposes (i.e., plan vs pre-paid). Thus, it is very difficult to monitor the experience of each specific service based on counters in the network management system, even if these are segregated per QCI. Thus, a more accurate traffic classification is needed for QCIs 6-9. In recent years, several methods for data traffic classification have been proposed. The simplest method is to identify the connection port [34]. However, currently, several applications use non-standard ports, and port assignment is often dynamic, meaning that there is no unequivocal relationship between a port number and service. More refined methods for traffic classification are based on the analysis of information exchanged along the session [35]. Such an approach cannot be applied for encrypted traffic services. Moreover, even for non-encrypted services, all these methods rely on information from high protocol layers, which can only be accessed by expensive network probes [36]. An option to solve these limitations consists of analyzing payload-independent flow characteristics. These methods exploit the fact that different applications show different features in their traffic that can be classified with Machine Learning (ML) techniques. Encrypted traffic classification has been extensively covered in the literature. In [37], a supervised learning algorithm is used to identify fingerprints of Android apps from their encrypted network traffic. However, supervised schemes require a labeled training dataset. Other alternatives use unsupervised learning algorithms to classify connections without the need of a previously-labeled dataset [38; 39]. In [38], an unsupervised method for offline coarse-grained traffic classification in cellular radio access networks is presented. This method relies on the fact that the identification of the class of service for a specific connection can be performed from a set of traffic descriptors showing the properties of data bursts in the connection. Unfortunately, radio connection traces do not explicitly register these traffic descriptors at the burst level, so that they must be estimated from other traffic parameters collected per connection. In the absence of labeled data that could be used as ground truth, the authors in [38] validate their method by comparing the traffic mix resulting from their classification algorithm against mobile traffic statistics published by a vendor. Results show that traffic shares per application class estimated by the proposed method are similar to those provided by a vendor report. The above-described method is used in this work in the absence of a large dataset of real traces that includes the service requested by the user for each radio connection, due to the difficulty of combining data from the radio access and core domains.