Traffic Classification Using Machine Learning
To ensure our Application Control module is future-proof, we are currently collaborating with a team from the Institute for Web Technologies & Applications at the University of Applied Sciences Kufstein (FH Kufstein Tirol). As part of a state-funded project, machine learning (ML) will be utilized to classify network traffic.
Initial Situation
As a form of Deep Packet Inspection (DPI), Application Control enables both network traffic monitoring and filtering. It allows administrators to ensure that certain applications or protocols are permitted entirely, with limited throughput, or blocked completely. This makes this IACBOX module a valuable tool for the WiFi operator: for instance, they can allow guests, employees, or visitors to check emails, while preventing them from streaming movies or series. This can be appropriate when it comes to utilizing available bandwidth efficiently or when dealing with user groups that have specific requirements. After all, it does not always make sense to treat a child and an adult, or a budget traveler and a luxury guest, in the exact same way.
Deep Packet Inspection generally works when one can either inspect the data of a connection or when the connection establishment is unambiguous. Here, it becomes clear what primarily motivated us to pursue such a project. An otherwise welcome development in data transmission has now become the greatest obstacle for DPI and, consequently, for our Application Control: increasingly encrypted connections.
What represents a clear win for data privacy and general online security becomes an obstacle for a network operator—even when they have entirely legitimate reasons for using DPI. Targeted restrictions allow network quality to remain high, tiered WiFi offerings at different price points ensure financing, and protection against unwanted or illegal content—such as for children or students—can be guaranteed.
Application Control recognizes encrypted connections only partially and tags them with the attribute “unknown”—meaning they can neither be blocked nor restricted in bandwidth. Encrypted connections (primarily HTTPS) will continue to increase in the future, which is why Application Control requires support.
What Does This Support Look Like?
A new technique for classifying data packets is required. This is where the team from FH Kufstein Tirol comes in. The project team from the Institute for Web Technologies & Applications, led by lecturer Lukas Huber, MSc, will be working until February 2020 to develop a viable method using machine learning. The goal of the first project phase is to distinguish WhatsApp connections from Facebook connections. In the process, connection metadata such as packet size, packet count, or packet timing are extracted and used to train the model. This is a self-learning algorithm where data is provided along with a defined goal.
Self-learning algorithms (Machine Learning): … You feed the machine data and a goal, provide feedback when it is on the right track, and then leave it to find the best path to that goal on its own.
Hannah Fry, Hello World
Speaking of artificial intelligence: It has been more than 20 years since IBM’s chess computer Deep Blue defeated the reigning world champion Garry Kasparov. At the time, that news dominated headlines across mainstream media for days. Today, while still fascinating, it is a development primarily noted by tech-savvy audiences in specialized columns when an AI like Google’s AlphaZero becomes a grandmaster within four hours without prior knowledge, defeating or drawing against Stockfish—currently the best chess engine—in 100 consecutive games.
Yet chess is merely a training ground: AI is becoming practical for everyday use and is already deployed across numerous defined fields. Projects like ours clearly demonstrate how artificial intelligence methods and techniques are making their way into more and more technologies in our daily lives.
The first phase of the IACBOX ML project is dedicated exclusively to fundamental research, determining which metadata is suitable for training. In the next step, the model will be further developed for practical application until it can be integrated into our product. Machine learning will play a crucial role in network traffic classification in the future, and this research project with the University of Applied Sciences Kufstein brings IACBOX one step closer to that goal.
