Auto-Generating Training Data For Network Application Classification

We present and evaluate the idea of auto-generating training data for network application classification using a rule-based expert system on two-dimensions of the feature space. That training data is then used to learn classification of network applications using other dimensions of the feature space. The rule-based expert system uses transport layer port number conventions (source port, destination port) from the Internet Assigned Numbers Authority (IANA) to classify applications to create the labeled training data. A classifier can then be trained on other network flow features using this auto-generated training data. We evaluate this approach to network application classification and report our findings. We explore the use of the following classifiers: K-nearest neighbors, decision trees, and random forests. Lastly, our approach uses data solely at the flow-level (in NetFlow v5 records) thereby limiting the volume of data that must be collected and/or stored.