Intrepretable Machine Learning using Decision Trees, by Novel Feature Engineering of Application Generated Packet Length Sequence Statistics

1. 11
Network Traffic Classification by Packet Length
Signature Extraction
Srinidhi H, Tamil Esai Somu, Madhusoodhana Chari S

2. Network Visibility
Dynamic Policy Enforcement
Enhanced Security
Traffic Classification
2
Introduction
Enhanced user
experience!!

3. Traffic Classification
3
Method
Data Collection
Feature Engineering
Classification

4. Packet Length Pattern and its Predictability
4
0
500
1000
1500
2000
1 4 7 10 13 16 19 22 25 28 31 34 37 40 43 46 49
VOIP
0
200
400
600
800
1000
1200
1400
1600
1 4 7 10 13 16 19 22 25 28 31 34 37 40 43 46 49
BROWSING
0
500
1000
1500
2000
1 4 7 10 13 16 19 22 25 28 31 34 37 40 43 46 49
FTP forward

5. FEATURE ENGINEERING
5
Our Solution
 Number of unique packet
lengths
 Statistics of Run Length
Type
Run Length Statistics
No. of
Unique
Packet
Length
Mean Std.
Deviation
Min Max
VOIP 3.26 3.49 1 11 5
FTP 4.75 5.58 1 22 3
Browsing 1.43 1.08 1 7 14

6. Classification and its Interpretability
6
Tree1: Generated with only packet length
statistics.
Tree2 : Generated with no. of unique packet
length, packet length and run length statistics

7. Future Expansions
7
 Expanding signature extraction methods –
LZW compression algorithm
 Programming the ASIC

8. 8