New class detection in network traffic classification using confidence information embedded cascade structure

Network traffic classification plays an important role in network management. With continued emergence of new applications, classifiers need to deal with unknown classes in an open set environment. However, the available open set flow recognition methods cannot well balance the performance of new class detection and the fine-grained classification of known classes. Moreover, these methods could pursue high accuracy at the cost of the classification speed. To address these problems, this paper proposes an unknown network traffic detection method based on confidence (difference) and a cascade structure, by analyzing the confidence distributions of both the known and new classes. The proposed method works as follows. Firstly, it uses a cascade structure to detect new class samples (having high confidence) which are difficult to identify using existing methods; secondly, it employs the maximum confidence difference to classify the new and known classes. In order to better detect new classes with high confidence, an algorithm is designed to select the pseudo-negative samples from the unlabelled dataset with an adaptive threshold. The proposed method is evaluated on real-world datasets. The results show that compared with the state-of-the-art methods, the proposed method can significantly improve the overall accuracy and the classification latency is also greatly reduced.