Performance analysis of network traffic capture tools and machine learning algorithms for the classification of applicat
- PDF / 4,729,564 Bytes
- 20 Pages / 595.276 x 790.866 pts Page_size
- 91 Downloads / 232 Views
ORIGINAL RESEARCH
Performance analysis of network traffic capture tools and machine learning algorithms for the classification of applications, states and anomalies T. P. Fowdur1 • B. N. Baulum1 • Y. Beeharry1
Received: 13 July 2019 / Accepted: 11 April 2020 Bharati Vidyapeeth’s Institute of Computer Applications and Management 2020
Abstract Network analytics is of key importance for the proper management of network resources as the rate of Internet traffic continues to rise. The aim of this paper is to investigate the performance of different network traffic capture tools for extracting features and to evaluate the performance of eight Machine Learning (ML) algorithms in the classification of (1) applications; (2) states and (3) anomalies. Six Internet applications were considered along with four PC states and two network anomalies. The network was monitored by three traffic capture tools: PRTG, Colasoft Capsa and Wireshark and classification was performed using the Weka Toolkit. The performance of the eight ML classifiers was determined based on several metrics. The Colasoft Capsa feature set gave the highest accuracy for the classification of applications while same was achieved with features from PRTG for the classification of the four states considered. For anomaly classification, the ML algorithms showed almost similar classification behavior when the Colasoft Capsa or PRTG feature set was used. Keywords Network analytics Traffic monitoring Machine learning Applications Anomalies Attacks
& T. P. Fowdur [email protected] B. N. Baulum [email protected] Y. Beeharry [email protected] 1
Department of Electrical and Electronics Engineering, University of Mauritius, Reduit, Mauritius
1 Introduction Network traffic, most commonly referred to as the amount of data being transferred across a network at a specific time, is increasing at a drastic rate as the Internet continues to grow in scope and complexity [1]. Network traffic can also be measured in terms of bandwidth or transmission capacity and is an important factor when determining the quality and speed of a network. The emergence of more and more applications running on Internet Protocol (IP) networks in different fields—including not only traditional Internet services such as WWW, FTP, and e-mail, but also multimedia services such as multimedia streaming, P2P file sharing and gaming—has yielded to network bandwidth growing from hundreds of Mbps to busier and faster wireless networks of more than 10 Gbps [2]. It is therefore crucial for networks to be monitored so as to understand their behavior in terms of applications and bandwidth usage, utilization of network resources, and to detect network anomalies and security issues, hence preventing overall network performance degradation or failure. The two main operations encompassing network analytics are traffic monitoring and traffic classification. Network traffic monitoring tools are employed by administrators in order to check for availability and maintain system stability by fi
Data Loading...
