Evaluating features for network application classification

In this paper, we evaluate the performance of several flow features to classify the network application that produced the flow. Correlating network traffic to network applications can assist with the critical network management tasks of performance assessment and network utilization accounting. Specifically, in this work we evaluate three engineered flow features and three inherent flow features (number of bytes, number of packets, and duration). For engineered features, we evaluate three host communication behavior features proposed by the authors of BLINC. Our experiments uncover the classification power of all combinations of the three engineered features in conjunction with the three inherent features. We utilize supervised machine learning algorithms such as k-nearest neighbors and decision trees. We utilize confidence intervals to uncover statistically significant classification differences among the combinations of flow features.