Traffic Classification Based on Zero-Length Packets

Joseph Kampeas, Asaf Cohen, Omer Gurewitz

Research output: Contribution to journalArticlepeer-review

19 Scopus citations


Network traffic classification is fundamental to network management and its performance. However, traditional approaches for traffic classification, which were designed to work on a dedicated hardware at very high line rates, may not function well in a virtual software-based environment. In this paper, we devise a novel fingerprinting technique that can be utilized as a software-based solution which enables machine-learning-based classification of ongoing flows. The suggested scheme is very simple to implement and requires minimal resources, yet attains very high accuracy. Specifically, for TCP flows, we suggest a fingerprint that is based on zero-length packets, hence enables a highly efficient sampling strategy which can be adopted with a single content-addressable memory rule. The suggested fingerprinting scheme is robust to network conditions such as congestion, fragmentation, delay, retransmissions, duplications, and losses and to varying processing capabilities. Hence, its performance is essentially independent of placement and migration issues, and thus yields an attractive solution for virtualized software-based environments. We suggest an analogous fingerprinting scheme for user datagram protocol traffic, which benefits from the same advantages as the TCP one and attains very high accuracy as well. Results show that our scheme correctly classified about 97% of the flows on the dataset tested, even on encrypted data.

Original languageEnglish
Article number8335764
Pages (from-to)1049-1062
Number of pages14
JournalIEEE Transactions on Network and Service Management
Issue number3
StatePublished - 1 Sep 2018


  • Network traffic classification
  • machine learning
  • network function virtualization
  • network monitoring and measurements
  • software-defined networking

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Electrical and Electronic Engineering


Dive into the research topics of 'Traffic Classification Based on Zero-Length Packets'. Together they form a unique fingerprint.

Cite this