Classifier device for network traffic and method of operating said classifier device

Abstract

Disclosed is a classifier device for network traffic (x) including a plurality of traffic classes (Nn) comprising a plurality of learners and plurality of rejection functions. The plurality of learners is associated with one of multiple mutually exclusive partitions (Kp) of the plurality of traffic classes (Nn). The plurality of learners is associated with a priority (p) with respect to one another. The plurality of learners is respectively configured to learn a respective classification of input features (xi) of traffic samples ((xi, yi)) of the associated partition (Kp) to class labels (yi) of the traffic samples ((xi, yi)) and to classify the input features (x / ) of the network traffic (x) to inferred class labels (yi) according to the respective classification. The plurality of rejection functions is configured to forward the network traffic (x) being classified as unknown for continued classification among the plurality of learners according to decreasing priority (p).

Description

[0001] CLASSIFIER DEVICE FOR NETWORK TRAFFIC AND

[0002] METHOD OF OPERATING SAID CLASSIFIER DEVICE

[0003] Technical Field

[0004] The present disclosure relates generally to the field of network traffic analytics, and more particularly to a classifier device for network traffic including a plurality of traffic classes, and a method of operating such a classifier device.

[0005] Background

[0006] Traffic classification (TC) engines are components of traffic monitoring systems aiming to identify which application has generated a network flow. TC engines need to cope with highly heterogeneous and dynamic network traffic, wherein popular applications generate >l,000x more flows than unpopular ones. If not handled properly, such extreme class imbalance leads to traffic classifiers with poor performance with respect to the identification of unpopular applications traffic.

[0007] Current traffic classification technologies involve deep packet inspection (DPI) or artificial intelligence (Al). DPI-based classifiers rely on very large catalogs of rules that can identify thousands of applications. Despite rules can be generated even from a single traffic flow (or even just one packet), those rules are typically hand-crafted. Thus, DPI-based classifiers require a lot of manual efforts and domain knowledge, suffer from poor automation and do not cope well with encrypted traffic, as rules are based on packets payload content which is not clearly visible when traffic is encrypted. Al-based classifiers rely on algorithms to learn patterns in a data-driven fashion. This means that Al-based classifiers are highly automated and better able to cope with encrypted traffic as they can simply rely on generic packet feature (e.g., packet size) without the need to check packet content (e.g., header field values). However, to train such classifiers, large labeled datasets are needed which usually can only be obtained for popular applications. Thus, Al-based classifiers typically target only tens of applications generating the majority of the traffic. In other words, while DPI-based classifiers handle extreme class imbalance by hand-driven designing of the classification rules, Al-based classifiers avoid the problem a priori by focusing only on popular applications, i.e., scenarios where little class imbalance is present.

[0008] Summary

[0009] It is an object to overcome these and other drawbacks by the combination of features of the independent claims. Further implementation forms are apparent from the dependent claims, the description and the figures.

[0010] According to a first aspect, a classifier device is provided for network traffic including a plurality of traffic classes. The classifier device comprises a plurality of learners and a plurality of rejection functions. The plurality of learners is respectively associated with one of multiple mutually exclusive partitions of the plurality of traffic classes. The plurality of learners is respectively associated with a priority with respect to one another. The plurality of learners is respectively configured to learn a respective classification of input features of traffic samples of the associated partition to class labels of the traffic samples. The plurality of learners is respectively configured to classify the input features of the network traffic to inferred class labels according to the respective classification. The plurality of rejection functions is respectively configured to forward the network traffic being classified as unknown for continued classification among the plurality of learners according to decreasing priority.

[0011] As such, each learner is configured to learn and classify based on input features of traffic samples related to a different partition of the plurality of traffic classes. Each learner is further accompanied by a rejection function that classifies an input sample as unknown when not belonging to any of the traffic classes the learner learned to recognize. Moreover, each rejection function is configured to forward the network traffic being classified as unknown for continued classification among the plurality of learners according to decreasing priority.

[0012] The classifier device implements a rejection-based ensemble that improves support for network traffic involving extreme class imbalance as follows:

[0013] The respective learner only has to deal with an exclusive subset of the plurality of traffic classes of the network traffic, rather than with all the traffic classes of the network traffic. As such, different policies may be used to partition the traffic among learners (load balancing) and different modeling techniques may be used for the plurality of learners (modularity).

[0014] Instead of ensembling / weighting a plurality of decisions based on voting or meta-models, the configuration of a rejection function allows to either accepted or rejected a classification decision Thus, only the classification of the learner being associated with the appropriate traffic class is relevant (simplification). In addition, the use of rejection functions enables by design the discovery of “unknown” traffic which is a desired property for traffic monitoring.

[0015] The respective learner also has a priority, and is provided with network traffic in accordance with decreasing priority. Thus, on average, only the most relevant subset of the plurality of learners needs to be consulted (resource efficiency).

[0016] In a possible implementation form, the respective learner may comprise a strong learner being configured to achieve a classification accuracy in excess of a predetermined accuracy threshold (e.g., 90 percent accuracy).

[0017] Strong learners involve high classification accuracy per se, and therefore obviate an ensembling / weighting of a plurality of classifications of weak learners (classification accuracy).

[0018] In a possible implementation form, the respective strong learner may be configured to perform machine learning in accordance with one of: a deep learning (DL) technique of a first set when a number of the traffic samples of each traffic class of the respective partition is below a predetermined sample threshold (i.e. number of samples); and a DL technique of a second set when the number of the traffic samples of each traffic class of the respective partition is greater than or equal to the predetermined sample threshold.

[0019] The respective strong learner may thus be associated with a learning model that is most appropriate for the number of the traffic samples of the associated partition (modularity).

[0020] In a possible implementation form, the first set may comprise: Few-Shot Learning (FSL) based on Prototypical Networks (ProtoNet) or Model-Agnostic Meta-Leaming (MAML), or other DL meta- leaming approaches. FSL as used herein may refer to a type of machine learning problems which can generalize from a labeled training dataset comprising a limited number of samples.

[0021] ProtoNet as used herein may refer to an instance of FSL in which classification amounts to mapping a sample to a nearest one of a plurality of class representations (i.e., mean vectors of the embedded support points) in accordance with a metric distance.

[0022] MAML as used herein may refer to an instance of FSL in which model parameters are trained such that a small number of gradient updates will result in fast learning on a new task.

[0023] DL meta-learning as used herein may refer to a plurality of FSL techniques of which ProtoNet and MAML are popular representative examples.

[0024] In a possible implementation form, the second set may comprise a Convolutional Neural Network, CNN, or alternative architectures based on Stacked Autoencoders, Multi-layer perceptron, Long- short term memory, configured for training by a Stochastic Gradient Descent, SGD.

[0025] CNN as used herein may refer to artificial neural networks including an input layer, an output layer, and hidden layers therebetween which may perform convolutions such as dot products, and whose convolution operation in turn contributes to the input of subsequent layers.

[0026] Stacked Autoencoders, Multi-layer perceptron, Long-short term memory as used herein may refer to alternative artificial neural networks with respect to CNN previously mentioned, yet still operating via an input layer, an output layer, and hidden layers therebetween to perform operations transforming an input value (e.g., traffic features) to an output value (e.g., a traffic class).

[0027] An SGD as used herein may refer to a stochastic approximation of gradient descent optimization by replacing an actual gradient (calculated from the entire data set) by an estimate thereof (calculated from a randomly selected subset of the data), achieving faster iterations in trade for a lower convergence rate.

[0028] In a possible implementation form, the plurality of learners may be configured to forward the network traffic being classified as unknown for continued classification among the plurality of learners according to a monotonously decreasing ordering of the priorities. The network traffic is forwarded to the respective learner according to monotonously decreasing priority, so that a sequence can be defined according to which the plurality of learners is consulted.

[0029] In a possible implementation form, the plurality of learners may be prioritized according to a size of the respective partition in terms of the traffic samples among the multiple partitions.

[0030] In accordance with size-based prioritization, those learners being associated with the most prevalent traffic classes may be consulted first, so as to consult only the most relevant subset of the plurality of learners on average (resource efficiency).

[0031] In a possible implementation form, the plurality of learners may be prioritized randomly.

[0032] In a possible implementation form, the respective rejection function may be configured to classify the network traffic as unknown by one of : gradient backpropagation rej ection; output-based rej ection, inner layers-based rejection; and input-based rejection.

[0033] In a possible implementation form, the gradient backpropagation rejection may comprise thresholding a magnitude of a first backpropagation step of the respective learner in accordance with the inferred class label of the input features of the network traffic.

[0034] In a possible implementation form, the input-based rejection may comprise K-means clustering of the input features of the network traffic and thresholding a distance metric between the input features of the network traffic and the cluster centroids.

[0035] In a possible implementation form, the inner layers-based rejection may comprise K-means clustering in a latent space of the respective learner and thresholding a distance metric between feature vectors of the input features of the network traffic and the cluster centroids.

[0036] In a possible implementation form, the output-based rejection may comprise maximizing a confidence score of the classification that the input features of the network traffic belong to each of the plurality of traffic classes.

[0037] According to a second aspect, a method is provided for operating a classifier device for network traffic including a plurality of traffic classes. The classifier device comprises a plurality of learners, respectively being associated with one of multiple mutually exclusive partitions of the plurality of traffic classes. The method comprises learning a respective classification of input features of traffic samples of the associated partition to class labels of the traffic samples. The method further comprises classifying the input features of the network traffic to inferred class labels according to the respective classification. The method further comprises forwarding the network traffic being classified as unknown for continued classification among the plurality of learners according to decreasing priority of the plurality of learners with respect to one another.

[0038] In a possible implementation form, the method may be performed by the classifier device of the first aspect or any of its implementations.

[0039] According to a third aspect, a computer program is provided comprising executable instructions which, when executed by a processor, cause the processor to perform the method of the second aspect or any of its implementations.

[0040] The technical effects and advantages described above in relation with the classifier device equally apply to the method of the second aspect as well as the computer program of the third aspect having corresponding features.

[0041] Brief Description of Drawings

[0042] The above-described aspects and implementations will now be explained with reference to the accompanying drawings, in which the same or similar reference numerals designate the same or similar elements.

[0043] The drawings are to be regarded as being schematic representations, and elements illustrated in the drawings are not necessarily shown to scale. Rather, the various elements are represented such that their function and general purpose become apparent to those skilled in the art.

[0044] FIG. 1 illustrates a traffic classifier in accordance with the present disclosure; and

[0045] FIG. 2 illustrates a method of operating a traffic classifier in accordance with the present disclosure. Detailed Descriptions of Drawings

[0046] In the following description, reference is made to the accompanying drawings, which form part of the disclosure, and which show, by way of illustration, specific aspects of embodiments of the present disclosure or specific aspects in which embodiments of the present disclosure may be used. It is understood that embodiments of the present disclosure may be used in other aspects and comprise structural or logical changes not depicted in the figures. The following detailed description, therefore, is not to be taken in a limiting sense, and the scope of the present disclosure is defined by the appended claims.

[0047] For instance, it is understood that a disclosure in connection with a described method may also hold true for a corresponding apparatus or system configured to perform the method and vice versa. For example, if one or a plurality of specific method steps are described, a corresponding device may include one or a plurality of units, e.g. functional units, to perform the described one or plurality of method steps (e.g. one unit performing the one or plurality of steps, or a plurality of units each performing one or more of the plurality of steps), even if such one or more units are not explicitly described or illustrated in the figures. On the other hand, for example, if a specific apparatus is described based on one or a plurality of units, e.g. functional units, a corresponding method may include one step to perform the functionality of the one or plurality of units (e.g. one step performing the functionality of the one or plurality of units, or a plurality of steps each performing the functionality of one or more of the plurality of units), even if such one or plurality of steps are not explicitly described or illustrated in the figures. Further, it is understood that the features of the various exemplary embodiments and / or aspects described herein may be combined with each other, unless specifically noted otherwise.

[0048] FIG. 1 illustrates a traffic classifier 1 in accordance with the present disclosure.

[0049] The classifier device 1 is designed for network traffic x that includes a plurality of traffic classes Nne[i;N] originated by respective applications.

[0050] The plurality of traffic classes Nn is represented in an upper part of FIG. 1 by a plurality of boxes identified as Ni to NN. Each of the plurality of traffic classes Nn is associated with a plurality of traffic samples (% / , yi) mapping input features xi to class labels yi e [1;N], For instance, in a traffic classification scenario xt can be a packet length for a number of initial packets of a flow, and yt may be one among TV applications.

[0051] Groups of traffic classes Nn may form multiple mutually exclusive partitions KPE[i:p], SO that the respective traffic class Nn belongs to only one partition KP. In the example of FIG. 1, partition Ki includes traffic classes Ni and N2, partition K2 includes traffic classes Ns and Nt, and so on, without loss of generality.

[0052] The classifier device 1 comprises a plurality of learnersPE[i;P].

[0053] The plurality of learners 11 is respectively associated with one of the multiple mutually exclusive partitions KPof the plurality of traffic classes Nn. In the example of FIG. 1, learner 117 is associated with partition Ki, learner 1 1 is associated with partition K2, and so on, up to learner l i which is associated with partition Kp. Since traffic classes Nn are mutually exclusive between partitions KP, each learner 1 lpaddresses a separate set of traffic classes Nn from the original dataset.

[0054] The respective learner 11 may comprise a strong learner being configured to achieve a traffic classification accuracy in excess of a predetermined accuracy threshold (e.g., 90 percent accuracy). In other words, each learner 11 needs to offer a classification performance significantly better than a random choice.

[0055] This ensemble / plurality of strong learners 11 supersedes less precise traditional ensembles of weak learners whose classifications are combined based on voting or meta models. However, such traditional ensembles are a still valid and complementary choice to the above. Traditional ensembles include random forests (which construct a multitude of decision trees in training, and return the class selected by most trees at inference), XGBoost (a particular instance of gradient boosting), and the like.

[0056] The respective strong learner may be configured to perform machine learning in accordance with one of a deep learning, DL, technique of a first set when a number of the traffic samples (% / , yi) of each traffic class of the respective partition KPis below a predetermined sample threshold; and a DL technique of a second set when the number of the traffic samples (% / , yi) of each traffic class of the respective partition KPis greater than or equal to the predetermined sample threshold. In particular, the first set may comprise: Few-Shot Learning, FSL, based on Prototypical Networks, ProtoNet, Model-Agnostic Meta-Learning, MAML, or other DL meta-learning methods. The second set may especially comprise a DL model based on Convolutional Neural Network, CNN, architecture configured for training by a Stochastic Gradient Descent, SGD, or alternative architectures based on Stacked Autoencoders, Multi-layer perceptron, Long-short term memory, just to name a few

[0057] During training, the plurality of learners 11 is respectively configured to learn a respective classification of input features xi of traffic samples (x;, yi) of the associated partition KPto class labels yi of the traffic samples (x;, yi). In other words, a separate learner 1 lpis trained for each partition KP.

[0058] During inference, the plurality of learners 11 is respectively configured to classify the input features Xi of the network traffic x to the inferred class label yt according to the respective classification. In FIG. 1, the respective learner 11Pis prompted with said network traffic x (see arrow extending rightward into the respective learner 11 / ?) and yields a classification of said network traffic x to inferred class labels y . (x, yi) (see arrow extending downwardly from the respective learner 1 1 / ;). This way, the respective learner l l / > is configured to perform a custom classification of the plurality of traffic classes Nnincluded in its associated partition KP.

[0059] The plurality of learners 11 is respectively associated with a priority p with respect to one another.

[0060] In particular, the plurality of learners 11 may be prioritized according to a size of the respective partition KPin terms of the traffic samples (x;, yi) among the multiple partitions KP. Alternatively, the plurality of learners 11 may be prioritized randomly.

[0061] The classifier device 1 further comprises a plurality of rejection functions 2P<E[i;pj, so that upon inference it may be identified if the network traffic x belongs to any of the traffic classes Nn handled by the associated learner 1 lpor not.

[0062] The plurality of P learners 11Pand the plurality of P rejection functions 12Pcorrespond to one another. As such, the respective rejection function 12Ponly has to accept or reject the inference (x, yi) of the associated learner 11P.

[0063] If the respective rejection function 12Paccepts the inference (x, yi) of the associated learner 11P(for more details see below), the classification is established as y = yPe KP. That is to say, the inferred class label yt of the associated partition KPis adopted as the correct class label y (see arrow extending downwardly from the respective rejection function 12P). Of note, only the classification of the appropriate learner 11 is adopted (i.e., no aggregation of multiple learners’ classification is required).

[0064] If the respective rejection function 12Prejects the inference (x, yi) of the associated learner 11Pas ‘unknown’ (i.e., not belonging to any of the plurality of traffic classes Nnforming the respective partition KP), chances are that the most appropriate learner 11Pfor the network traffic x has not been consulted yet.

[0065] As such, the plurality of rejection functions 12 is respectively configured to forward the network traffic x being classified as unknown for continued classification among the plurality of learners 11 according to decreasing priority p, and in particular according to a monotonously decreasing ordering of the priorities p (see arrow extending rightward from the respective rejection function 12P). As can be seen, the network traffic x being classified as unknown by a respective learner 11Pis forwarded to a subsequent learner llp>p. In other words, the plurality of learners 11 is prioritized with respect to one another, and the priority dictates the order by which learners 11 are consulted to define the final classification. As such, the first learner 1 b to be consulted has the highest priority p=l, and the next learner 1 1 to be consulted has the next lower priority p=2, and so on. In summary, learners’ 11 execution is pre-arranged (e.g., chained through rejection functions 12).

[0066] Rejecting the inference (x, yi) of the associated learner 11Pas ‘unknown’ requires informed decisionmaking by the respective rejection function 12P.

[0067] To this end, the respective rejection function 12 may be configured to classify the network traffic x as unknown by one of: gradient backpropagation rejection; output-based rejection, inner layers-based rejection; and input-based rejection.

[0068] The gradient backpropagation rejection may comprise thresholding a magnitude of a first backpropagation step of the respective learner 11 in accordance with the inferred class label yt of the input features xi of the network traffic x.

[0069] The input-based rejection may comprise K-means clustering of the input features xi of the network traffic x and thresholding a distance metric between the input features xi of the network traffic x and the cluster centroids. The inner layers-based rejection may comprise K-means clustering in a latent space of the respective learner 11 and thresholding a distance metric between feature vectors FV(xi) of the input features xi of the network traffic x and the cluster centroids.

[0070] The output-based rejection may comprise maximizing a confidence score of the classification that the input features xi of the network traffic x belong to each of the plurality of traffic classes Nn.

[0071] If none of the plurality of rejection functions 12Paccepts the inference (x, yi) of its associated learner lip, the network traffic x is classified as “unknown”, i.e., it belongs to a new traffic class for which the rejection-based ensemble has not been trained to recognize.

[0072] FIG. 2 illustrates a method 2 of operating a traffic classifier 1 in accordance with the present disclosure.

[0073] As already mentioned, the network traffic x includes a plurality of traffic classes Nn.

[0074] The classifier device 1 comprises a plurality of learners 11, respectively being associated with one of multiple mutually exclusive partitions KPof the plurality of traffic classes Nn.

[0075] The method 2 comprises learning 21 a respective classification of input features xi of traffic samples (xi, yi) of the associated partition to class labels yi of the traffic samples (% / , yi).

[0076] The method 2 further comprises classifying 22 the input features xi of the network traffic x to inferred class labels yi according to the respective classification.

[0077] The method 2 further comprises forwarding 23 the network traffic x being classified as unknown for continued classification among the plurality of learners 11 according to decreasing priority p of the plurality of learners 11 with respect to one another.

[0078] The method 2 may be performed by the classifier device 1 of the first aspect or any of its implementations.

[0079] The present disclosure has been described in conjunction with various embodiments as examples as well as implementations. However, other variations can be understood and effected by those persons skilled in the art and practicing the claimed matter, from the studies of the drawings, this disclosure and the independent claims. In the claims as well as in the description the word “comprising” does not exclude other elements or steps and the indefinite article “a” or “an” does not exclude a plurality. A single element or other unit may fulfill the functions of several entities or items recited in the claims. The mere fact that certain measures are recited in the mutual different dependent claims does not indicate that a combination of these measures cannot be used in an advantageous implementation.

[0080] A computer program may be stored / distributed on a suitable medium, such as an optical storage medium or a solid-state medium supplied together with or as part of other hardware, but may also be distributed in other forms, such as via the Internet or other wired or wireless telecommunication systems.

Claims

Claims1. A classifier device (1) for network traffic (x) including a plurality of traffic classes (Nn), the classifier device (1) comprising a plurality of learners (11), respectively being associated with one of multiple mutually exclusive partitions (Kp) of the plurality of traffic classes (An); being associated with a priority ( / ?) with respect to one another; being configured to learn a respective classification of input features (x;) of traffic samples (xi, yi) of the associated partition (KP) to class labels (yi) of the traffic samples (x;, j ); and being configured to classify the input features (x;) of the network traffic (x) to inferred class labels (yi) according to the respective classification; and a plurality of rejection functions (12), respectively being configured to forward the network traffic (x) being classified as unknown for continued classification among the plurality of learners (11) according to decreasing priority (p).

2. The classifier device (1) of claim 1, the respective learner (11) comprising a strong learner being configured to achieve a classification accuracy in excess of a predetermined accuracy threshold of 90 percent.

3. The classifier device (1) of claim 2, the respective strong learner being configured to perform machine learning in accordance with one of- a deep learning, DL, technique of a first set when a number of the traffic samples (x;, yi) of each traffic class of the respective partition (KP) is below a predetermined sample threshold; and- a DL technique of a second set when the number of the traffic samples (x;, yi) of each traffic class of the respective partition (KP) is greater than or equal to the predetermined sample threshold.

4. The classifier device (1) of claim 3, the first set comprising:- Few-Shot Learning, FSL, based on Prototypical Networks, ProtoNet, or Model-Agnostic Meta-Learning, MAML.

5. The classifier device (1) of claim 3 or claim 4, the second set comprising:- a Convolutional Neural Network, CNN, configured for training by a Stochastic Gradient Descent, SGD.

6. The classifier device (1) of any one of the claims 1 to 5, the plurality of learners (11) being configured to forward the network traffic (x) being classified as unknown for continued classification among the plurality of learners (11) according to a monotonously decreasing ordering of the priorities ( / ?).

7. The classifier device (1) of any one of the claims 1 to 6, the plurality of learners (11) being prioritized according to a size of the respective partition (KP) in terms of the traffic samples (x;, yi) among the multiple partitions (Kp).

8. The classifier device (1) of any one of the claims 1 to 6, the plurality of learners (11) being prioritized randomly.

9. The classifier device (1) of any one of the claims 1 to 8, the respective rejection function (12) being configured to classify the network traffic (x) as unknown by one of:- gradient backpropagation rejection;- output-based rejection.- inner layers-based rejection; and- input-based rejection.

10. The classifier device (1) of claim 9, the gradient backpropagation rejection comprising thresholding a magnitude of a first backpropagation step of the respective learner (11) in accordance with the inferred class label (yi) of the input features (x;) of the network traffic (x).

11. The classifier device (1) of claim 9, the input-based rejection comprising K-means clustering of the input features (x;) of the network traffic (x) and thresholding a distance metric between the input features (x;) of the network traffic (x) and the cluster centroids.

12. The classifier device (1) of claim 9, the inner layers-based rejection comprising K-means clustering in a latent space of the respective learner (11) and thresholding a distance metric between feature vectors (FV(xi) of the input features (x;) of the network traffic (x) and the cluster centroids.

13. The classifier device (1) of claim 9, the output-based rejection comprising maximizing a confidence score of the classification that the input features (x;) of the network traffic (x) belong to each of the plurality of traffic classes (Nn).

14. A method (2) of operating a classifier device (1) for network traffic (x) including a plurality of traffic classes (Nn), the classifier device (1) comprising a plurality of learners (11), respectively being associated with one of multiple mutually exclusive partitions (KP) of the plurality of traffic classes ( ); the method (2) comprising learning (21) a respective classification of input features (x;) of traffic samples (x;, yi) of the associated partition to class labels (yi) of the traffic samples (x;, j ); classifying (22) the input features (x;) of the network traffic (x) to inferred class labels (yi) according to the respective classification; andforwarding (23) the network traffic (x) being classified as unknown for continued classification among the plurality of learners (11) according to decreasing priority ( / ?) of the plurality of learners (11) with respect to one another.

15. The method (2) of claim 14, being performed by the classifier device (1) of any one of the claims 1 - 13.

16. A computer program comprising executable instructions which, when executed by a processor, cause the processor to perform the method (2) of claim 14 or claim 15.

Images