Analyzing network traffic for protocol identification: an ensemble online active learning method

Analyzing network traffic to identify protocols is the basis of cybersecurity detection and management. However, network protocol analysis is challenged by the problem of concept drift and class imbalance. Moreover, as the network traffic are arriving at high speed, it is also costly to label the traffic data in real time. In this paper, an ensemble online active learning method is proposed. To select the most representative samples and the minority class samples in the network traffic streams, the novel hybrid active learning labeling strategy based on predicted uncertainty and class imbalance ratio is proposed, which uses margin value as criterion and decision threshold based on the class imbalance ratio. To make full use of the labeled samples, a samples training weight adjustment mechanism is designed to enhance the performance of the ensemble classifier. Moreover, the drift detection mechanism is also integrated into the ensemble classifier to detect possible drift in the traffic stream and evolve the classifier. Experimental results show that the proposed method has a good protocol identification ability especially on the minority class protocols.