Network Traffic Categorization Using PCA and Ensemble Learning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network traffic classification methods, such as port-based, payload-based, and flow statistics-based, face challenges in accurately classifying traffic, especially in congested networks and with encrypted traffic, leading to classification failures.
Innovation Solution
A method and apparatus utilizing ensemble learning and principal component analysis (PCA) to classify traffic by preprocessing flow data, generating input data, and performing machine learning to enhance classification precision.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If port-based method is used for traffic classification, then classification is simple to implement, but classification accuracy deteriorates because not all services use standard port numbers
Solution Approach 1:
The patent segments the traffic classification process into multiple independent classification models (port-based classifier, payload-based classifier, flow statistics-based classifier) that operate in parallel. Each classifier handles specific aspects of traffic identification, and their results are combined through voting or weighting mechanisms to achieve accurate classification while maintaining implementation simplicity.
Solution Approach 2:
The patent merges multiple classification approaches (port-based, payload-based, flow statistics-based) into an ensemble learning system. By combining the strengths of different classification methods and aggregating their outputs, the system achieves high classification accuracy without sacrificing the ease of implementation of individual methods.
2Measurement precision
If payload-based method is used for traffic classification, then classification accuracy is improved by identifying application signatures, but classification reliability deteriorates with increased encrypted traffic
Solution Approach 1:
The patent segments the classification task into multiple specialized classifiers, including port-based, payload-based, and flow statistics-based models. When encrypted traffic is detected, the system can rely on port-based and flow statistics-based classifiers rather than payload analysis, maintaining reliability across different traffic types.
Solution Approach 2:
The patent dynamically changes the parameters and methods used for classification based on traffic characteristics. For encrypted traffic, the system adjusts by relying more on port numbers and flow statistics rather than payload content, thereby maintaining classification reliability despite the presence of encryption.
3Adaptability or versatility
If flow statistics-based method is used for traffic classification, then classification adaptability is improved for new services, but classification precision deteriorates under network congestion
Solution Approach 1:
The patent divides the classification system into multiple independent models that can be selectively applied. Flow statistics-based classification is used as one component among others, allowing the system to adapt to new services while compensating for precision losses under congestion through the combined results of other classifiers.
Solution Approach 2:
The patent merges flow statistics-based classification with port-based and payload-based classification methods. This combination allows the system to maintain adaptability to new services through flow analysis while achieving higher precision by cross-validating with other classification approaches, especially under congested network conditions.
Data Source
AI summary
A traffic categorization method and device are disclosed. A traffic categorization method according to one embodiment of the present invention may comprise the steps of: receiving flow data comprising information about a flow; scaling for the flow data; generating input data by removing, on the basis of a correlation, overlapping data from the scaled flow data; and categorizing a network traffic on the basis of the input data.