Online classification of network flows is a process that captures packets generated by network applications and identifies types of network applications (or flows) in real time. There are three key issues about online classification: observation window size, feature selection, and classification algorithms.
In this paper, by collecting five types of typical network flow data as the experiment sample data, the authors found observation window size 7 is the best for the sample data and most classifiers. The authors proposed a full feature set based on the standard feature set which reflects statistical features of network flows. Using five commonly used feature selection methods, the authors identified the most effective features could be reduced from 56 original features to 11 effective features. Lastly, according to special need for online classification, the authors studied 11 different classifiers on their classification accuracy, model construction time, and classification speed. The results show that C4.5 and JRip are the two best algorithms for online classification.