{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,22]],"date-time":"2026-03-22T06:11:12Z","timestamp":1774159872668,"version":"3.50.1"},"reference-count":38,"publisher":"Hindawi Limited","license":[{"start":{"date-parts":[[2016,1,1]],"date-time":"2016-01-01T00:00:00Z","timestamp":1451606400000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Journal of Computer Networks and Communications"],"published-print":{"date-parts":[[2016]]},"abstract":"<jats:p>Traffic classification utilizing flow measurement enables operators to perform essential network management. Flow accounting methods such as NetFlow are, however, considered inadequate for classification requiring additional packet-level information, host behaviour analysis, and specialized hardware limiting their practical adoption. This paper aims to overcome these challenges by proposing two-phased machine learning classification mechanism with NetFlow as input. The individual flow classes are derived per application through<mml:math xmlns:mml=\"http:\/\/www.w3.org\/1998\/Math\/MathML\" id=\"M1\"><mml:mrow><mml:mi>k<\/mml:mi><\/mml:mrow><\/mml:math>-means and are further used to train a C5.0 decision tree classifier. As part of validation, the initial unsupervised phase used flow records of fifteen popular Internet applications that were collected and independently subjected to<mml:math xmlns:mml=\"http:\/\/www.w3.org\/1998\/Math\/MathML\" id=\"M2\"><mml:mrow><mml:mi>k<\/mml:mi><\/mml:mrow><\/mml:math>-means clustering to determine unique flow classes generated per application. The derived flow classes were afterwards used to train and test a supervised C5.0 based decision tree. The resulting classifier reported an average accuracy of 92.37% on approximately 3.4 million test cases increasing to 96.67% with adaptive boosting. The classifier specificity factor which accounted for differentiating content specific from supplementary flows ranged between 98.37% and 99.57%. Furthermore, the computational performance and accuracy of the proposed methodology in comparison with similar machine learning techniques lead us to recommend its extension to other applications in achieving highly granular real-time traffic classification.<\/jats:p>","DOI":"10.1155\/2016\/2048302","type":"journal-article","created":{"date-parts":[[2016,6,6]],"date-time":"2016-06-06T21:00:31Z","timestamp":1465246831000},"page":"1-21","source":"Crossref","is-referenced-by-count":49,"title":["On Internet Traffic Classification: A Two-Phased Machine Learning Approach"],"prefix":"10.1155","volume":"2016","author":[{"given":"Taimur","family":"Bakhshi","sequence":"first","affiliation":[{"name":"Center for Security, Communications and Network Research, University of Plymouth, Plymouth PL4 8AA, UK"}]},{"given":"Bogdan","family":"Ghita","sequence":"additional","affiliation":[{"name":"Center for Security, Communications and Network Research, University of Plymouth, Plymouth PL4 8AA, UK"}]}],"member":"98","reference":[{"key":"1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2014.11.001"},{"key":"2","doi-asserted-by":"publisher","DOI":"10.1002\/nem.1872"},{"key":"4","doi-asserted-by":"publisher","DOI":"10.1145\/1163593.1163596"},{"key":"5","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2013.06.006"},{"key":"6","doi-asserted-by":"publisher","DOI":"10.1109\/mnet.2012.6135854"},{"key":"12","doi-asserted-by":"publisher","DOI":"10.1109\/tnet.2010.2044046"},{"key":"8","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2010.12.004"},{"issue":"1","key":"10","doi-asserted-by":"crossref","first-page":"5","DOI":"10.1145\/1198255.1198257","volume":"37","year":"2007","journal-title":"ACM SIGCOMM Computer Communication Review"},{"key":"11","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"crossref","first-page":"122","DOI":"10.1007\/978-3-642-20305-3_11","volume-title":"Early classification of network traffic through multi-classification","volume":"6613","year":"2011"},{"key":"13","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-00975-4_16"},{"key":"15","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2008.11.016"},{"key":"16","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"crossref","first-page":"123","DOI":"10.1007\/978-3-642-36784-7_6","volume-title":"Reviewing traffic classification","volume":"7754","year":"2013"},{"key":"17","doi-asserted-by":"publisher","DOI":"10.1145\/216585.216588"},{"key":"20","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-71617-4_19"},{"key":"23","doi-asserted-by":"publisher","DOI":"10.1145\/2133360.2133364"},{"key":"29","doi-asserted-by":"publisher","DOI":"10.1109\/tpds.2013.307"},{"issue":"4","key":"30","first-page":"370","volume":"3","year":"2009","journal-title":"International Journal of Engineering"},{"key":"33","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-07941-7_2"},{"key":"34","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-12365-8_11"},{"key":"35","doi-asserted-by":"publisher","DOI":"10.1109\/mnet.2014.6786614"},{"key":"38","doi-asserted-by":"publisher","DOI":"10.1145\/1925861.1925865"},{"key":"39","doi-asserted-by":"publisher","DOI":"10.1145\/1656274.1656278"},{"key":"70","year":"2006"},{"key":"72","doi-asserted-by":"publisher","DOI":"10.1109\/tnet.2014.2320577"},{"issue":"3","key":"36","doi-asserted-by":"crossref","first-page":"65","DOI":"10.1145\/1273445.1273454","volume":"37","year":"2007","journal-title":"ACM SIGCOMM Computer Communication Review"},{"key":"41","year":"2006"},{"key":"48","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2008.09.022"},{"key":"49","doi-asserted-by":"publisher","DOI":"10.1109\/tmm.2013.2265531"},{"key":"73","series-title":"RR-06-12","year":"2006"},{"key":"58","doi-asserted-by":"publisher","DOI":"10.2307\/2685209"},{"key":"53","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2014.01.008"},{"key":"54","doi-asserted-by":"publisher","DOI":"10.1037\/h0026256"},{"issue":"2","key":"55","first-page":"248","volume":"22","year":"1996","journal-title":"Computational Linguistics"},{"key":"56","doi-asserted-by":"publisher","DOI":"10.18637\/jss.v028.i05"},{"key":"57","year":"1993"},{"key":"62","doi-asserted-by":"publisher","DOI":"10.1214\/aos\/1016218223"},{"key":"64","doi-asserted-by":"publisher","DOI":"10.1145\/1961189.1961199"},{"key":"67","year":"1989"}],"container-title":["Journal of Computer Networks and Communications"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/downloads.hindawi.com\/journals\/jcnc\/2016\/2048302.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/downloads.hindawi.com\/journals\/jcnc\/2016\/2048302.xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/downloads.hindawi.com\/journals\/jcnc\/2016\/2048302.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2017,6,24]],"date-time":"2017-06-24T15:50:32Z","timestamp":1498319432000},"score":1,"resource":{"primary":{"URL":"http:\/\/www.hindawi.com\/journals\/jcnc\/2016\/2048302\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016]]},"references-count":38,"alternative-id":["2048302","2048302"],"URL":"https:\/\/doi.org\/10.1155\/2016\/2048302","relation":{},"ISSN":["2090-7141","2090-715X"],"issn-type":[{"value":"2090-7141","type":"print"},{"value":"2090-715X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2016]]}}}