Abstract
Flow classification is of great significance for network management. Machine-learning-based flow classification is widely used nowadays, but features which depict the non-Gaussian characteristics of network flows are still absent. In this paper, we propose the Windowed Higher-order Statistical Analysis (WHOSA) for machine-learning-based flow classification. In our methodology, a network flow is modeled as three different time series: the flow rate sequence, the packet length sequence and the inter-arrival time sequence. For each sequence, both the higher-order moments and the largest singular values of the Bispectrum are computed as features. Some lower-order statistics are also computed from the distribution to build up the feature set for contrast, and C4.5 decision tree is chosen as the classifier. The results of the experiment reveals the capability of WHOSA in flow classification. Besides, when the classifier gets fully learned, the WHOSA feature set exhibit stronger discriminative power than the lower-order statistical feature set does.