Mobile Networks and Applications

, Volume 23, Issue 4, pp 789–796 | Cite as

Internet Traffic Classification Based on Incremental Support Vector Machines

  • Guanglu Sun
  • Teng Chen
  • Yangyang Su
  • Chenglong LiEmail author


Machine learning methods have been deployed widely in Internet traffic classification, which identify encrypted traffic and proprietary protocols effectively based on statistical features of traffic flows. Among these methods, support vector machines (SVMs) have attracted increasing attention as it achieves the state of art performance in traffic classification compared with other machine learning methods. However, traditional SVMs-based traffic classifier also has its limitations in real application: high training complexity and computation cost on both memory and CPU, which leads to the frequent and timely updating of traffic classifier being impractical. In this paper, incremental SVMs (ISVM) model is first introduced to reduce the high training cost of memory and CPU, and realize traffic classifier’s high-frequency and quick updates Besides, a modified version of ISVM model with attenuation factor, called AISVM, is further proposed to utilize valuable information in the previous training data sets. The experimental results have proved the effectiveness of ISVM and AISVM models in traffic classification.


Internet traffic classification Incremental learning Support vector machines Attenuation factor 



This work was partly financially supported through grants from the National Natural Science Foundation of China (No. 60903083 and 61502123), Scientific planning issues of education in Heilongjiang Province (No. GBC1211062), and the research fund for the program of new century excellent talents (No. 1155-ncet-008). The authors thank the anonymous reviewers for their helpful suggestions.


  1. 1.
    Kim H, Claffy K C, Fomenkov M, et al (2008) Internet traffic classification demystified: myths, caveats, and the best practices[C]//Proceedings of the 2008 ACM CoNEXT conference. ACM, 1-12Google Scholar
  2. 2.
    Karagiannis T, Papagiannaki K, Faloutsos M (2005) BLINC: multilevel traffic classification in the dark[C]//ACM SIGCOMM Computer Communication Review. ACM 35(4):229-240Google Scholar
  3. 3.
    Nguyen T T T, Armitage G (2008) A survey of techniques for internet traffic classification using machine learning[J]. IEEE Commun Surveys Tutor 10(4):56-76Google Scholar
  4. 4.
    Wang Y, Yu S Z (2008) Machine learned real-time traffic classifiers[C]. Intelligent Information Technology Application, 2008. IITA’08. Second International Symposium on IEEE, 3 p 449-454Google Scholar
  5. 5.
    Este A, Gringoli F, Salgarelli L (2009) Support vector machines for TCP traffic classification[J]. Comput Netw 53(14):2476–2490CrossRefzbMATHGoogle Scholar
  6. 6.
    Yuan R, Li Z, Guan X et al (2010) An SVM-based machine learning method for accurate internet traffic classification[J]. Inf Syst Front 12(2):149–156CrossRefGoogle Scholar
  7. 7.
    Bashar A, Parr G et al (2014) Application of Bayesian networks for autonomic network management. J Netw Syst Manag 22(2):174–207CrossRefGoogle Scholar
  8. 8.
    Zhang J, Xiang Y et al (2013) Network traffic classification using correlation information. IEEE Trans Parallel Distrib Syst 24(1):104–117CrossRefGoogle Scholar
  9. 9.
    Monemi A, Zarei R, Marsono MN (2013) Online NetFPGA decision tree statistical traffic classifier[J]. Comput Commun 36(12):1329–1340CrossRefGoogle Scholar
  10. 10.
    Auld T, Moore AW, Gull SF (2007) Bayesian neural networks for internet traffic classification[J]. IEEE Trans Neural Netw 18(1):223–239CrossRefGoogle Scholar
  11. 11.
    Syed NA, Liu H, and Sung KK (1999) Handling concept drifts in incremental learning with support vector machines. In Proceedings of the Fifth ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. ACM Press, New York, NY, pages 272-276Google Scholar
  12. 12.
    A. Moore and K. Papagiannaki. Toward the Accurate Identification of Network Applications. In Proceedings of PAM Workshop, 2005Google Scholar
  13. 13.
    Pan Z, Liu S, Fu W (2017) A review of visual moving target tracking[J]. Multimed Tools Appl 76(16):16989–17018CrossRefGoogle Scholar
  14. 14.
    Liu S, Cheng X, Fu W et al (2014) Numeric characteristics of generalized M-set with its asymptote[J]. Appl Math Comput 243:767–774MathSciNetzbMATHGoogle Scholar
  15. 15.
    Dainotti A, Pescape A, and Claffy KC (2012) Issues and future directions in traffic classification. IEEE Netw 26(1):35-40CrossRefGoogle Scholar
  16. 16.
    Perera P, Tian Y C, Fidge C, et al (2017) A Comparison of Supervised Machine Learning Algorithms for Classification of Communications Network Traffic[C]//International Conference on Neural Information Processing. Springer, Cham, 445-454Google Scholar
  17. 17.
    Moore A and Zuev D (2005) Internet traffic classification using Bayesian analysis techniques[C]. ACM SIGMETRICS-2005, Banff, Alberta, p 50-60Google Scholar
  18. 18.
    Williams N, Zander S, Armitage G (2006) A preliminary performance comparison of five machine learning algorithms for practical IP traffic flow classification[J]. ACM SIGCOMM Comput Commun Rev 36(5):5–16CrossRefGoogle Scholar
  19. 19.
    Finamore A, Mellia M, Meo M, et al (2010) Kiss: Stochastic packet inspection classifier for udp traffic[J]. IEEE/ACM Trans Netw (TON) 18(5):1505-1515CrossRefGoogle Scholar
  20. 20.
    Nguyen TTT, Armitage G, Branch P, et al (2012) Timely and continuous machine-learning-based classification for interactive IP traffic[J]. IEEE/ACM Trans Netw (TON) 20(6):1880-1894CrossRefGoogle Scholar
  21. 21.
    Ye W, Cho K (2014) Hybrid P2P traffic classification with heuristic rules and machine learning[J]. Soft Comput 18(9):1815–1827CrossRefGoogle Scholar
  22. 22.
    Li D, Hu G, Wang Y et al (2015) Network traffic classification via non-convex multi-task feature learning[J]. Neurocomputing 152:322–332CrossRefGoogle Scholar
  23. 23.
    Peng L, Yang B, Chen Y (2015) Effective packet number for early stage internet traffic identification[J]. Neurocomputing 156:252–267CrossRefGoogle Scholar
  24. 24.
    Ruping S. (2001) Incremental learning with support vector machines[C]. Data Mining, 2001. ICDM 2001, Proceedings IEEE International Conference on. IEEE, p 641-642Google Scholar
  25. 25.
    Laskov P, Gehl C, Kruger S, Muller K (2006) Incremental support vector learning: analysis, implementation and applications[J]. J Mach Learn Res 7:1909–1936MathSciNetzbMATHGoogle Scholar
  26. 26.
    Shilton A, Palaniswami M, Ralph D et al (2005) Incremental training of support vector machines[J]. IEEE Trans Neural Netw 16(1):114–131CrossRefGoogle Scholar
  27. 27.
    Tsai C H, Lin C Y, Lin C J. (2014) Incremental and decremental training for linear classification[C]. Proceedings of the 20th ACM SIGKDD international conference on Knowledge discovery and data mining. ACM, p 343-352Google Scholar
  28. 28.
    Moore AW and Zuev D (2005) Discriminators for use in flow-based classification [R]. Technical report, Intel Research, CambridgeGoogle Scholar

Copyright information

© Springer Science+Business Media, LLC, part of Springer Nature 2018

Authors and Affiliations

  1. 1.School of Computer Science and TechnologyHarbin University of Science and TechnologyHarbinChina
  2. 2.Research Center of Information Security & Intelligent TechnologyHarbin University of Science and TechnologyHarbinChina
  3. 3.National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT/CC)BeijingChina

Personalised recommendations