Traffic Classification of Mobile Apps through Multi-classification

The wide spreading and growing usage of smartphones are deeply changing the kind of traffic that traverses home and enterprise networks and the Internet. Tools that base their functions on the knowledge of the application generating the traffic (performance enhancement proxies, network monitors, policy enforcement devices) imply traffic classification, and are thus limited or impaired when dealing with the daily expanding set of mobile apps. Besides the moving-target nature of mobile apps traffic, the increasing adoption of encrypted protocols (TLS) makes classification even more challenging, defeating established approaches (DPI, statistical classifiers). In this paper we aim to improve the classification performance of mobile apps classifiers adopting a multi-classification approach, intelligently-combining decisions from state-of-art classifiers proposed for mobile and encrypted traffic classification. Based on a dataset of users' activity collected by a mobile solutions provider, our results demonstrate that classification performance can be improved according to all considered metrics, up to +8.1% F-measure score with respect to the best base classifier. Further room for improvements is also evidenced by the ideal combiner performance (oracle).