WHOSA: Network Flow Classification Based on Windowed Higher-Order Statistical Analysis

Mingda WANG  Gaolei FEI  Guangmin HU  

IEICE TRANSACTIONS on Communications   Vol.E99-B   No.5   pp.1024-1031
Publication Date: 2016/05/01
Online ISSN: 1745-1345
DOI: 10.1587/transcom.2015AMP0003
Type of Manuscript: Special Section PAPER (Special Section on Internet Architectures and Management Methods that Enable Flexible and Secure Deployment of Network Services)
higher-order statistics,  sliding window,  decision tree,  feature extraction,  flow classification,  

Full Text: PDF(964.9KB)>>
Buy this Article

Flow classification is of great significance for network management. Machine-learning-based flow classification is widely used nowadays, but features which depict the non-Gaussian characteristics of network flows are still absent. In this paper, we propose the Windowed Higher-order Statistical Analysis (WHOSA) for machine-learning-based flow classification. In our methodology, a network flow is modeled as three different time series: the flow rate sequence, the packet length sequence and the inter-arrival time sequence. For each sequence, both the higher-order moments and the largest singular values of the Bispectrum are computed as features. Some lower-order statistics are also computed from the distribution to build up the feature set for contrast, and C4.5 decision tree is chosen as the classifier. The results of the experiment reveals the capability of WHOSA in flow classification. Besides, when the classifier gets fully learned, the WHOSA feature set exhibit stronger discriminative power than the lower-order statistical feature set does.