Confidence Driven Classification of Application Types in the Presence of Background Network Traffic
Eun Hun Choi, Jasleen Kaur, Vladas Pipiras, Nelson Gomes Rodrigues Antunes, Brendan Massey
TL;DR
This work addresses the gap between well-performing application-traffic classifiers on curated datasets and their weaker performance on real-world traffic containing pervasive background traffic. It demonstrates that including background traffic as a separate class improves but also destabilizes predictions due to high heterogeneity and session-specific background content. To resolve this, the authors build a confidence-aware framework using embeddings trained with supervised contrastive loss, cosine similarity to class centroids, and Gaussian Mixture Model clustering to quantify and filter uncertainty. Compared to softmax-based filtering, the GMM-based approach achieves comparable or better macro F1 while maintaining higher relevant coverage, making the classifier more reliable for real-world monitoring and resource allocation. The work also outlines practical directions for online deployment, including concept-drift detection triggered by rising uncertainty.
Abstract
Accurately classifying the application types of network traffic using deep learning models has recently gained popularity. However, we find that these classifiers do not perform well on real-world traffic data due to the presence of non-application-specific generic background traffic originating from advertisements, analytics, shared APIs, and trackers. Unfortunately, state-of-the-art application classifiers overlook such traffic in curated datasets and only classify relevant application traffic. To address this issue, when we label and train using an additional class for background traffic, it leads to additional confusion between application and background traffic, as the latter is heterogeneous and encompasses all traffic that is not relevant to the application sessions. To avoid falsely classifying background traffic as one of the relevant application types, a reliable confidence measure is warranted, such that we can refrain from classifying uncertain samples. Therefore, we design a Gaussian Mixture Model-based classification framework that improves the indication of the deep learning classifier's confidence to allow more reliable classification.