A Framework for Classifying Applications from Raw Network Traffic Traces

In this paper, we study and present the design of a framework to identify applications from raw network traces. Framing the problem as an application classification problem, we set up the framework to extract key features from packet data and their temporal behavior. The feature generation, their training using traditional machine learning models, and the decision making are executed over a four- stage pipeline, to yield the name of the application. Through an in-lab environment experimentation using Open Wrt toolkit, RaspberryPi, and a set of physical devices (generating network traffic), we evaluated on average about 204K data points from the captured network packet traces for six applications. Our results show that our method is able to classify the applications with at least 90% accuracy. Through micro-benchmarking, we also show the feasibility of scaling the number of applications and running the tool in real-time.