Adaptive mobile application identification through in-network machine learning
Takamitsu Iwai, Akihiro Nakao · 2016
Application identification is beneficial for malware detection, content cache, application-specific QoS, traffic control, etc. The existing identification methods using machine learning are usually limited to identification of protocols, not applications, and hard to adapt to the emergence of new applications. We have been proposing a new method for adaptive application identification with machine learning where we create training dataset in real-time by tagging traffic with application process names from a small number of modified smartphones and identify the unknown flow using the classifier trained by the training data. Our previous research [1] achieves more than 80% of accuracy in application identification when not using DPI (Deep Packet Inspection). In this paper, we propose an extension to the previous method using DPI and on-line machine learning with pre-classification of traffic based on ports to improve the inference accuracy. The evaluation shows that our method can identify more than 92% of traffic accurately using DPI when learning period is 5 days, and achieves up to 93% of accuracy at best for general traffic. When limited to HTTP, the accuracy becomes 96%. This result shows that we can build a system identifying more than 92% of the applications adaptively in relatively short training period, e.g., 5 days of training, even when new applications emerge. We envision that our proposed system eventually enables application specific traffic engineering as well as application specific network function execution within the network.