Lightweight Internet Traffic Classification - A Subject Based Solution with Word Embeddings

Internet traffic classification is a relevant and mature research field, anyway of growing importance and with still open technical challenges, also due to the pervasive presence of Internet-connected devices into everyday life. We claim the need for innovative traffic classification solutions capable of being lightweight, of adopting a domain-based approach, of not only concentrating on application-level protocol categorization but also classifying Internet traffic by subject. To this purpose, this paper originally proposes a classification solution that leverages domain name information extracted from IPFIX summaries, DNS logs, and DHCP leases, with the possibility to be applied to any kind of traffic. Our proposed solution is based on an extension of Word2vec unsupervised learning techniques running on a specialized Apache Spark cluster. In particular, learning techniques are leveraged to generate word-embeddings from a mixed dataset composed by domain names and natural language corpuses in a lightweight way and with general applicability. The paper also reports lessons learnt from our implementation and deployment experience that demonstrates that our solution can process 5500 IPFIX summaries per second on an Apache Spark cluster with 1 slave instance in Amazon EC2 at a cost of $ 3860 year. Reported experimental results about Precision, Recall, F-Measure, Accuracy, and Cohen's Kappa show the feasibility and effectiveness of the proposal. The experiments prove that words contained in domain names do have a relation with the kind of traffic directed towards them, therefore using specifically trained word embeddings we are able to classify them in customizable categories. We also show that training word embeddings on larger natural language corpuses leads improvements in terms of precision up to 180%.

Down to the sea in ships /

Mode of access: Internet.

Two details of ships.

[From Jasper Cropsey Sketch book, 1855-1856]

A lightweight pneumatic coring device : design and field test /

"September 1982."

Ships, aircraft and weapons of the United States Navy.

Item 370

Ship maintenance: foreign commercial shipyard repairs to U.S. government ships.

Mode of access: Internet.

Navy ships: status of SSN-32 ship construction program.

Mode of access: Internet.

The gallant deeds of our naval heroes : told for boys and girls : including the adventures of Captain Paul Jones, Commodore Perry, commodore Decatur, Admiral Farragut, Admiral Dewey, and many others of America's brave sailors who won glory in battles at home and abroad; also the story of the ships made famous by great battles and great captains /

Mode of access: Internet.

A treatise of the law relative to merchant ships and seamen : in five parts ... /

Abbott on shipping.

Results of tests on 25 bureau of ships - RCA developmental Williams memory tubes - type C73376B /

"April 29, 1953"

Ships off a Rocky Coast

Adam Willaerts; 2 ft. 39/64 in.x 4 ft. 5/64 in.; oil on panel