he variety and complexity of modern Internet traffic exceeds anything imagined by the original designers of the underlying Internet architecture. As the Internet becomes our most critical communications infrastructure, service providers attempt to retrofit functionality, including security, reliability, privacy, and multiple service qualities, into a "best effort" architecture originally intended to support a research environment. In order to prioritize, protect, or prevent certain traffic, providers need to implement technology for traffic classification: associating traffic flows with the applications -or application types -that generated them. When the focus is on detecting specific applications (e.g., Skype), the term traffic identification is sometimes used. Despite the increasing dependence on the Internet, there is essentially no scientifically reproducible body of research on global Internet traffic characteristics due to the sensitivity of and typical restrictions on sharing traffic data. Despite these constraints, security concerns and economic realities have motivated recent advances in traffic classification capabilities. Situational awareness of traffic is essential to prevention, mitigation, and response to new forms of malware, which can suddenly and rapidly threaten legitimate service on network links. Arguably as important, the high cost of deploying and operating Internet infrastructure compels providers to continually seek ways to optimize their network engineering or otherwise increase return on capital investments, including applicationbased service differentiation and content-sensitive pricing. For these reasons, the state of the art in traffic classification has experienced a major boost in the past few years, measured in the number of publications and research groups focused on the topic. Diverse interests have led to a heterogeneous, fragmented, and somewhat inconsistent landscape. A recent survey of traffic classification literature reviewed advantages and problems with different approaches, but acknowledged their general lack of accuracy and applicability [1] , whereas others took a narrower focus, taxonomizing and reviewing documented machine-learning approaches for IP traffic classification [2] . In this article we provide a critical but constructive analysis of the field of Internet traffic classification, focusing on major obstacles to progress and suggestions for overcoming them. We first give an overview of both the evolution of traffic classification techniques and constraints to their development. After briefly summarizing results of surveys in this field, we highlight key differences across existing approaches and techniques. We then discuss the main obstacles to progress in the current state of the art, including required trade-offs in applicability, reliability, performance, and respect for privacy. The persistently unsolved challenges in the field over the last decade suggest the need for different strategies and actions, which we recommend in the concluding section. At least three historical developments over the last two decades have rendered less accurate the traditional method of using transport-layer (TCP and UDP) ports to infer most Internet applications (port-based approach): • The proliferation of new applications that have no IANA registered ports, but instead use ports already registered (to other applications), randomly selected, or user-defined • The incentive for application designers and users to use well-known ports (assigned to other applications) to disguise their traffic and circumvent filtering or firewalls • The inevitability of IPv4 address exhaustion, motivating pervasive deployment of network and port address translation, T T Alberto Dainotti and Antonio Pescapé, University of Napoli Federico II Kimberly C. Claffy, University of California San Diego Traffic classification technology has increased in relevance this decade, as it is now used in the definition and implementation of mechanisms for service differentiation, network design and engineering, security, accounting, advertising, and research. Over the past 10 years the research community and the networking industry have investigated, proposed and developed several classification approaches. While traffic classification techniques are improving in accuracy and efficiency, the continued proliferation of different Internet application behaviors, in addition to growing incentives to disguise some applications to avoid filtering or blocking, are among the reasons that traffic classification remains one of many open problems in Internet research. In this article we review recent achievements and discuss future directions in traffic classification, along with their trade-offs in applicability, reliability, and privacy. We outline the persistently unsolved challenges in the field over the last decade, and suggest several strategies for tackling these challenges to promote progress in the science of Internet traffic classification.
The detailed analysis of traffic classification, its historical context, breakthroughs achieved so far and technical reasons which are hindering the accuracy and effectiveness of classification techniques are summarized in REF .
Issues and future directions in traffic classification
IEEE Network
IEEE Network
Computer Science