Machine Learning for Network Traffic Classification Under Labeled Data and Training Time Constraints

Aug 5, 2026

Upload by Eden

This thesis investigates using machine learning, including deep learning, for network traffic classification under practical constraints: limited labeled data and insufficient training time for models trained from scratch. Network traffic classification is central to network security, network management, and application identification, yet labeling is costly and time-intensive. The work develops a semi-supervised method leveraging positively labeled and unlabeled data via bootstrap aggregation and tree-based classifiers to classify unlabeled flows and detect zero-day encrypted messaging applications without training data. It also explores deep transfer learning by converting network flows into grayscale traffic images and transferring from state-of-the-art computer vision models to accelerate training.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages126

Reading Time5 h 18 min

AccessFree to download

Abstract

Chapter 1 Introduction

Chapter 2 Network Traffic Flow Collection for Mobile Applications and Campus Area Network Wi-Fi

2.2 Mobile Application and Campus Wi-Fi Data Collection

2.4 Data Representation

Chapter 3 Positive and Unlabeled Learning for Mobile Application Traffic Classification

3.6 Positive and Unlabeled (PU) Learning

3.9 Related Work

Chapter 4 Generalizing Machine Learning Models for Zero-Day Encrypted Messaging Applications

MACHINE LEARNING FOR NETWORK TRAFFIC CLASSIFICATION UNDER LABELED DATA AND TRAINING TIME CONSTRAINTS by Jason P. Hussey © Copyright by Jason P. Hussey, 2023 All Rights Reserved A thesis submitted to the Faculty and the Board of Trustees of the Colorado School of Mines in partial fulfillment of the requirements for the degree of Doctor of Philosophy (Computer Science) . Golden, Colorado Date Signed: Jason P. Hussey Signed: Dr. Tracy K. Camp Thesis Advisor Signed: Dr. Kerri A. Stone Thesis Advisor Golden, Colorado Date Signed: Dr. Iris Bahar Department Head and Professor Department of Computer Science ABSTRACT This thesis investigates using machine learning (including deep learning) for network traffic classification when constrained by too little labeled data or insufficient time to train models from scratch. Network traffic classification is essential in network security, network management, and application identification. Labeling network traffic data, however, is often time-consuming and expensive, which limits the amount of labeled data available for training machine learning models. This thesis investigates using a semi-supervised learning approach that leverages positively labeled and unlabeled data to improve classification performance when faced with a lack of labeled data. The method uses a combination of bootstrap aggregation and tree-based classifiers to classify unlabeled network traffic flows from the same class successfully. This same semi-supervised learning approach also successfully detects zero-day (i.e., never before seen) encrypted messaging applications for which no training data is available. Additionally, this thesis investigates using deep transfer learning from a state-of-the-art computer vision model for network traffic image classification. By representing network traffic flows as grayscale network traffic images, highly sophisticated image classification models can transfer to the task of network traffic classification. Using these advanced models as a source for training dramatically enhances the speed at which new models can train, addressing the constraint of having too little time for training. To investigate whether deep transfer learning is successful in network traffic image classification, this work used our network flow capture system (which creates a volume of unlabeled data) and commercial appliances (to turn the unlabeled dataset into a real-world labeled dataset) . Experimental results in this thesis demonstrate that the semi-supervised learning technique of positive and unlabeled learning is highly effective at detecting hidden positives amongst unlabeled data. Furthermore, this thesis shows that representing network traffic flows as grayscale images allows state-of-the-art image classification models (e.g., ResNet) to transfer to the domain of network traffic classification effectively. TABLE OF CONTENTS ABSTRACT .............................................. iii LIST OF FIGURES ......................................... viii LIST OF TABLES ........................................... x ACKNOWLEDGMENTS ...................................... xii DEDICATION ............................................ xiii CHAPTER 1 INTRODUCTION ................................... 1 CHAPTER 2 NETWORK TRAFFIC FLOW COLLECTION FOR MOBILE APPLICATIONS AND CAMPUS AREA NETWORK WI-FI .......... 5 2.1 Introduction .......................................... 5 2.2 Mobile Application and Campus Wi-Fi Data Collection ................. 6 2.2.1 Android Application Traffic Capture ........................ 6 2.2.2 Campus Wi-Fi Capture ............................... 8 2.3 Experimental Design ..................................... 9 2.4 Data Representation .................................... 10 2.5 Acknowledgment ...................................... 11 CHAPTER 3 POSITIVE AND UNLABELED LEARNING FOR MOBILE APPLICATION TRAFFIC CLASSIFI

FAQs

What challenge does this thesis address in network traffic classification?

It addresses the difficulty of training accurate classifiers when labeled traffic data is scarce and when there is not enough time to train models from scratch.

How does the thesis improve classification with limited labeled data?

It uses a semi-supervised approach based on positive and unlabeled learning, combining bootstrap aggregation with tree-based classifiers to learn from positively labeled and unlabeled flows.

How does the thesis handle zero-day encrypted messaging applications?

It demonstrates that the positive and unlabeled learning approach can detect zero-day encrypted messaging applications even when no training data is available.

Aug 5, 2026

Upload by Eden