Unsupervised Traffic Flow Classification Using a Neural Autoencoder

To cope with the varying delay and bandwidth requirements of today's mobile applications, mobile wireless networks can profit from classifying and predicting mobile application traffic. State-of-the-art traffic classification approaches have various disadvantages: port-based classification methods can be circumvented by choosing non-standard ports, protocol fingerprinting can be confused by the use of encryption, and current supervised learning methods for analyzing the statistical properties of network flows try to detect predefined classes, such as e-mail or FTP traffic, learned during training. In this paper, we present a novel approach to unsupervised traffic flow classification using statistical properties of flows and clustering based on a neural auto encoder. A novel time interval based feature vector construction and a semi-automatic cluster labeling method facilitate traffic flow classification independent of known traffic classes. An experimental evaluation on real data captured over a period of four months is presented. The obtained results show that 7 different classes of mobile traffic flows are detected with an average precision of 80% and an average recall of 75%.