Internet traffic classification demystified: myths, caveats, and the best practices

Recent research on Internet traffic classification algorithms has yield a flurry of proposed approaches for distinguishing types of traffic, but no systematic comparison of the various algorithms. This fragmented approach to traffic classifica-tion research leaves the operational community with no ba-sis for consensus on what approach to use when, and how to interpret results. In this work we critically revisit traffic clas-sification by conducting a thorough evaluation of three clas-sification approaches, based on transport layer ports, host behavior, and flow features. A strength of our work is the broad range of data against which we test the three classi-fication approaches: seven traces with payload collected in Japan, Korea, and the US. The diverse geographic locations, link characteristics and application traffic mix in these data allowed us to evaluate the approaches under a wide variety of conditions. We analyze the advantages and limitations of each approach, evaluate methods to overcome the limi-tations, and extract insights and recommendations for both the study and practical application of traffic classification. We make our software, classifiers, and data available for re-searchers interested in validating or extending this work. 1