<i>FastFlow</i> : Early Yet Robust Network Flow Classification using the Minimal Number of Time-Series Packets

Internet service providers (ISPs) that operate high-speed links expect network flow classifiers to accurately classify flows as early as possible, be robust to packet sequence disorders, and be capable of detecting the existence of unseen flow types. We develop FastFlow , a time-series flow classification method that achieves the above objectives, which dynamically selects the minimal number of packets at runtime to balance accuracy and efficiency. Our method first represents the packet streams of a flow at both per-packet and per-slot granularity for precise packet statistics with robustness to packet sequence disorders. A sequential decision-based classification model that leverages the LSTM architecture is developed. The model makes dynamic decisions on the minimal number of time-series data points to classify each flow. We evaluated our method on three public datasets and demonstrated its superior performance in early and accurate flow classification. Deployment insights on the classification of over 22.9 million flows across seven application types and 33 content providers in a campus network over one week are discussed.