{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,8]],"date-time":"2026-05-08T15:49:08Z","timestamp":1778255348338,"version":"3.51.4"},"reference-count":35,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2012,3,1]],"date-time":"2012-03-01T00:00:00Z","timestamp":1330560000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000144","name":"Division of Computer and Network Systems","doi-asserted-by":"publisher","award":["CNS-0905037CNS-1017647"],"award-info":[{"award-number":["CNS-0905037CNS-1017647"]}],"id":[{"id":"10.13039\/100000144","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Knowl. Discov. Data"],"published-print":{"date-parts":[[2012,3]]},"abstract":"<jats:p>\n            The ability to accurately and scalably classify network traffic is of critical importance to a wide range of management tasks of large networks, such as tier-1 ISP networks and global enterprise networks. Guided by the practical constraints and requirements of traffic classification in large networks, in this article, we explore the design of an accurate and scalable machine learning based flow-level traffic classification system, which is trained on a dataset of flow-level data that has been annotated with application protocol labels by a packet-level classifier. Our system employs a lightweight\n            <jats:italic>modular architecture<\/jats:italic>\n            , which combines a series of simple linear binary classifiers, each of which can be efficiently implemented and trained on vast amounts of flow data in parallel, and embraces three key innovative mechanisms,\n            <jats:italic>weighted threshold sampling, logistic calibration<\/jats:italic>\n            , and\n            <jats:italic>intelligent data partitioning<\/jats:italic>\n            , to achieve scalability while attaining high accuracy. Evaluations using real traffic data from multiple locations in a large ISP show that our system accurately reproduces the labels of the packet level classifier when runs on (unlabeled) flow records, while meeting the scalability and stability requirements of large ISP networks. Using training and test datasets that are two months apart and collected from two different locations, the flow error rates are only 3% for TCP flows and 0.4% for UDP flows. We further show that such error rates can be reduced by combining the information of spatial distributions of flows, or\n            <jats:italic>collective traffic statistics<\/jats:italic>\n            , during classification. We propose a novel two-step model, which seamlessly integrates these collective traffic statistics into the existing traffic classification system. Experimental results display performance improvement on all traffic classes and an overall error rate reduction by 15%. In addition to a high accuracy, at runtime, our implementation easily scales to classify traffic on 10Gbps links.\n          <\/jats:p>","DOI":"10.1145\/2133360.2133364","type":"journal-article","created":{"date-parts":[[2012,3,27]],"date-time":"2012-03-27T15:17:31Z","timestamp":1332861451000},"page":"1-34","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":73,"title":["A Modular Machine Learning System for Flow-Level Traffic Classification in Large Networks"],"prefix":"10.1145","volume":"6","author":[{"given":"Yu","family":"Jin","sequence":"first","affiliation":[{"name":"University of Minnesota"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Nick","family":"Duffield","sequence":"additional","affiliation":[{"name":"AT&amp;T Labs -- Research"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jeffrey","family":"Erman","sequence":"additional","affiliation":[{"name":"AT&amp;T Labs -- Research"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Patrick","family":"Haffner","sequence":"additional","affiliation":[{"name":"AT&amp;T Labs -- Research"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Subhabrata","family":"Sen","sequence":"additional","affiliation":[{"name":"AT&amp;T Labs -- Research"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zhi-Li","family":"Zhang","sequence":"additional","affiliation":[{"name":"University of Minnesota"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2012,3]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/1368436.1368445"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/1326257.1326279"},{"key":"e_1_2_1_3_1","volume-title":"Proceedings of the 29th Conference on Information Communications (INFOCOM). 206--210","author":"Chen A.","unstructured":"Chen , A. , Jin , Y. , Cao , J. , and Li , L . 2010. Tracking long duration flows in network traffic . In Proceedings of the 29th Conference on Information Communications (INFOCOM). 206--210 . Chen, A., Jin, Y., Cao, J., and Li, L. 2010. Tracking long duration flows in network traffic. In Proceedings of the 29th Conference on Information Communications (INFOCOM). 206--210."},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/1198255.1198257"},{"key":"e_1_2_1_5_1","unstructured":"Duda R. O. Hart P. E. and Stork D. G. 2000. Pattern Classification. Wiley-Interscience. Duda R. O. Hart P. E. and Stork D. G. 2000. Pattern Classification . Wiley-Interscience."},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.peva.2007.06.014"},{"key":"e_1_2_1_7_1","volume-title":"Proceedings of the 2nd European Conference on Computational Learning Theory (EuroCOLT).","author":"Freund Y.","unstructured":"Freund , Y. and Schapire , R. E . 1995. A decision-theoretic generalization of on-line learning and an application to boosting . In Proceedings of the 2nd European Conference on Computational Learning Theory (EuroCOLT). Freund, Y. and Schapire, R. E. 1995. A decision-theoretic generalization of on-line learning and an application to boosting. In Proceedings of the 2nd European Conference on Computational Learning Theory (EuroCOLT)."},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDMW.2007.15"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/1080173.1080183"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/1298306.1298349"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/1658939.1658967"},{"key":"e_1_2_1_12_1","volume-title":"Proceedings of the 28th IEEE International Conference on Computer Communications Workshops (INFOCOM). 37--42","author":"Iliofotou M.","unstructured":"Iliofotou , M. , Kim , H. , Faloutsos , M. , Mitzenmacher , M. , Pappu , P. , and Varghese , G . 2009b. Graph-based p2p traffic classification at the internet backbone . In Proceedings of the 28th IEEE International Conference on Computer Communications Workshops (INFOCOM). 37--42 . Iliofotou, M., Kim, H., Faloutsos, M., Mitzenmacher, M., Pappu, P., and Varghese, G. 2009b. Graph-based p2p traffic classification at the internet backbone. In Proceedings of the 28th IEEE International Conference on Computer Communications Workshops (INFOCOM). 37--42."},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1162\/neco.1991.3.1.79"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/1321753.1321771"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/1555349.1555356"},{"key":"e_1_2_1_16_1","volume-title":"Proceedings of the 22nd International Teletraffic Congress (ITC\u201922)","author":"Jin Y.","unstructured":"Jin , Y. , Duffield , N. , Haffner , P. , Sen , S. , and Zhang , Z . -L. 2010a. Inferring applications at the network layer using collective traffic statistics . In Proceedings of the 22nd International Teletraffic Congress (ITC\u201922) . Jin, Y., Duffield, N., Haffner, P., Sen, S., and Zhang, Z.-L. 2010a. Inferring applications at the network layer using collective traffic statistics. In Proceedings of the 22nd International Teletraffic Congress (ITC\u201922)."},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/1811039.1811082"},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/1028788.1028804"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/1080091.1080119"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/1177080.1177123"},{"key":"e_1_2_1_21_1","volume-title":"Proceedings of the 13th Annual Network and Distributed System Security Symposium (NDSS).","author":"McDaniel P.","unstructured":"McDaniel , P. , Sen , S. , Spatscheck , O. , der Merwe , J. V. , Aiello , B. , and Kalmanek , C . 2006. Enterprise security: A community of interest based approach . In Proceedings of the 13th Annual Network and Distributed System Security Symposium (NDSS). McDaniel, P., Sen, S., Spatscheck, O., der Merwe, J. V., Aiello, B., and Kalmanek, C. 2006. Enterprise security: A community of interest based approach. In Proceedings of the 13th Annual Network and Distributed System Security Symposium (NDSS)."},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/1064212.1064220"},{"key":"e_1_2_1_23_1","volume-title":"Proceedings of the AAAI Workshop on Learning Statistical Models from Relational Data. AAAI.","author":"Neville J.","unstructured":"Neville , J. and Jensen , D . 2000. Iterative classification in relational data . In Proceedings of the AAAI Workshop on Learning Statistical Models from Relational Data. AAAI. Neville, J. and Jensen, D. 2000. Iterative classification in relational data. In Proceedings of the AAAI Workshop on Learning Statistical Models from Relational Data. AAAI."},{"key":"e_1_2_1_24_1","volume-title":"Proceedings of the Australian Telecommunication Networks and Application Conference. 293--297","author":"Nguyen T.","unstructured":"Nguyen , T. and Armitage , G . 2006a. Synthetic sub-flow pairs for timely and stable IP traffic identification . In Proceedings of the Australian Telecommunication Networks and Application Conference. 293--297 . Nguyen, T. and Armitage, G. 2006a. Synthetic sub-flow pairs for timely and stable IP traffic identification. In Proceedings of the Australian Telecommunication Networks and Application Conference. 293--297."},{"key":"e_1_2_1_25_1","volume-title":"Proceedings of the 31st Conference on Local Computer Networks. IEEE.","author":"Nguyen T.","unstructured":"Nguyen , T. and Armitage , G . 2006b. Training on multiple sub-flows to optimise the use of machine learning classifiers in real-world IP networks . In Proceedings of the 31st Conference on Local Computer Networks. IEEE. Nguyen, T. and Armitage, G. 2006b. Training on multiple sub-flows to optimise the use of machine learning classifiers in real-world IP networks. In Proceedings of the 31st Conference on Local Computer Networks. IEEE."},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/1015330.1015412"},{"key":"e_1_2_1_27_1","volume-title":"Proceedings of the 13th Conference on Neural Information Processing Systems (NIPS).","author":"Platt J.","year":"1999","unstructured":"Platt , J. 1999 . Probabilistic outputs for support vector machines and comparison to regularized likelihood methods . In Proceedings of the 13th Conference on Neural Information Processing Systems (NIPS). Platt, J. 1999. Probabilistic outputs for support vector machines and comparison to regularized likelihood methods. In Proceedings of the 13th Conference on Neural Information Processing Systems (NIPS)."},{"key":"e_1_2_1_28_1","unstructured":"Rifkin R. and Klautau A. 2004. In defense of one-vs-all classification. J. Mach. Learn. Res. 101--141. Rifkin R. and Klautau A. 2004. In defense of one-vs-all classification. J. Mach. Learn. Res. 101--141."},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1023\/A:1007649029923"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/988672.988742"},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1609\/aimag.v29i3.2157"},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/1402958.1402991"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/1163593.1163596"},{"key":"e_1_2_1_34_1","volume-title":"Data Mining: Practical Machine Learning Tools and Techniques with Java Implementations. Morgan Kaufmann.","author":"Witten I. H.","year":"1999","unstructured":"Witten , I. H. and Frank , E . 1999 . Data Mining: Practical Machine Learning Tools and Techniques with Java Implementations. Morgan Kaufmann. Witten, I. H. and Frank, E. 1999. Data Mining: Practical Machine Learning Tools and Techniques with Java Implementations. Morgan Kaufmann."},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/1080091.1080112"}],"container-title":["ACM Transactions on Knowledge Discovery from Data"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2133360.2133364","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2133360.2133364","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T10:06:05Z","timestamp":1750241165000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2133360.2133364"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2012,3]]},"references-count":35,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2012,3]]}},"alternative-id":["10.1145\/2133360.2133364"],"URL":"https:\/\/doi.org\/10.1145\/2133360.2133364","relation":{},"ISSN":["1556-4681","1556-472X"],"issn-type":[{"value":"1556-4681","type":"print"},{"value":"1556-472X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2012,3]]},"assertion":[{"value":"2010-06-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2011-06-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2012-03-01","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}