Accurate identification and classification of network traffic according to the application that generated them is at the basis of any modern network management platform. Nowadays, many P2P applications using dynamic port numbers, masquerading techniques and encryption to avoid detection. Therefore, simple port-based and systematic analyses of packet payloads methods are rapidly inefficient. An alternative approach is to classify traffic rely on the fact that different applications have distinct behavior patterns when they communicate on a network. We present this latter approach to effectively identify groups of traffic that are similar using only transport layer statistical information. In this study, we propose a traffic monitoring scheme based on IPFIX standard that employs the clustering algorithms as a classification tool to classify network traffics using only transport layer\\\\\\\'s information. We believe that in order to build an accurate classifier, a good classification model must be used. For building such model, we considers three unsupervised clustering algorithms, namely K-Means, DBSCAN and SNN, for cluster training data that the latter has not previously been used for network traffic classification. We evaluate this algorithm and compare to the previously used K-Means and DBSCAN algorithms, using empirical internet traces.

Keywords