A CNN-Random Forest Hybrid Model for Network Traffic Classification

Internet service providers (ISPs) have been using Machine Learning (ML)-based network traffic classification in recent years primarily to dynamically adjust their networks to the growing needs of their customers. Even though ML models have several advantages in classifying network traffic, especially in their ability to automatically adapt to ever-changing network traffic patterns, our understanding of their accuracy and generalizability remains limited. In this paper, we evaluate the generalizability of the best performing state-of-the-art machine learning models used for network classification on a Gaming Traffic Dataset and suggest an architecture for enhanced classification of a large number of classes. Initially, we evaluate Random Forest (RF) utilizing pre-engineered variables including packet length, inter-arrival periods, and other flow data. Additionally, we evaluate another state-of-the-art model, the Convolutional Neural Network (CNN), which receives raw network data that has been transformed into either an RGB or gray-scale image. Furthermore, we propose a classification system that consists of two phases: an unsupervised phase governed by Density-Based Spatial Clustering of Applications with Noise (DBSCAN) clustering, followed by a supervised phase that consists of a stacked arrangement of sub CNN base models and a final Random Forest meta estimator. The evaluation of this semi-supervised stacked CNN–RF model shows that it outperforms the state-of-the-art RF and CNN models, achieving a 7.186% improvement in the testing accuracy in the dataset, and an average 1.7% improvement in the testing accuracy for other datasets.