| Network traffic classification differentiates huge traffic mixture into application categories. Accurate and fast online traffic classification in the realistic ultra-high speed and dynamic network environment is of fundamental importance to network operations, resource optimization and management. It has been shown that machine learning based traffic classification can offer high accuracy on application identification without deep inspection of packet payloads or causing privacy concerns; most of studies, however, used offline traffic trace archives, and their classification speed was too poor to support live traffic classification. On the other hand, concept drift, caused by the intrinsic changing characteristics hidden in complex and variant network traffic, inevitably leads to deterioration in accuracy over time for traffic classification systems. In the meantime, performance challenges posed by ultra-high-speed network environment require us to explore highly efficient hardware and software designs.;In the dissertation, we propose an implementation of complete online network traffic classification system with the capability of concept drift detection and programmable flow feature extraction, in order to accurately and quickly identify the application type of network traffic. we propose a new incremental learning algorithm to perform traffic classification with the ability to handle concept drift hidden in traffic. Next, we present a series of implementations to speed up flow feature extraction, which is the foundation of many feature-based network applications. To exploit multi-core processors, we implement different software designs with parallel, pipelined and hybrid architecture. We leverage the OpenFlow protocol to implement programmable feature extraction and handle concept drift in traffic dynamics. We demonstrate the preliminary work of feature extraction on NetFPGA platform using the reference pipeline architecture. Then, we present a new decision tree searching method by leveraging advanced memory architectures in modern FPGA devices, in order to speed up the classification process. |
