Flow classification using clustering and association rule mining

Abstract

Traffic classification has become a crucial domain of research due to the rise in applications that are either encrypted or tend to change port consecutively. The challenge of flow classification is to determine the applications involved without any information on the payload. In this paper, our goal is to achieve a robust and reliable flow classification using data mining techniques. We propose a classification model which not only classifies flow traffic, but also performs behavior pattern profiling. The classification is implemented by using clustering algorithms, and association rules are derived by using the "Apriori" algorithms. We are able to find an association between flow parameters for various applications, therefore making the algorithm independent of the characterized applications. The rule mining helps us to depict various behavior patterns for an application, and those behavior patterns are then fed back to refine the classification model.