Online classification of network traffic based on granular computing

At present, it is still a great challenge to achieve online classification of traffic flows due to the highly varying network environments, e.g., unpredictable new traffic classes, network noise and congestion. Traditional classification methods work well in stable network environments, but may not exhibit their performance in dynamic environments. To address online classification issues, a granular computing based classification model (GCCM) is developed, where the spatial and temporal flow granules are defined to make GCCM robust against variations and less sensitive to noise, and the correlations among flow granules are explored to establish the granular relation matrix (GRM). The inherent burst features between packets indicated by GRM prompt GCCM to achieve fine classification in unstable network environments. GCCM analyzes the burst features of packets without inspecting the payload information, and thus can be used to classify encrypted traffic as well as unencrypted traffic at a fast speed. In addition, GCCM model, depending on difference measurement D(·), is a threshold based classification, and therefore can be used to distinguish between time-varying classes. The validity of GCCM for online traffic classification is examined through theoretical results. The experimental evaluation of classification for fine and varied classes under dynamic network environments with noise and congestion also demonstrates its superiority in terms of classification accuracy and real-time performance with the state-of-the-art.