Classifying peer-to-peer applications using imbalanced concept-adapting very fast decision tree on IP data stream

Peer-to-Peer (P2P) applications generate streaming data in large volumes, where new communities of peers regularly attend and existing communities of peers regularly leave, requiring the classification techniques to consider concept drift, and update the model incrementally. Concept-adapting Very Fast Decision Tree (CVFDT) is one of the well-known streaming data mining techniques that can be applied to P2P traffic. However, we observe that P2P traffic data is class imbalanced, namely, only about 30 % of examples can be labeled as “P2P”, biasing the trained models (e.g. decision tree) towards the majority class (i.e. “NonP2P”). In this paper, we propose a new technique, the imbalanced CVFDT (iCVFDT), by integrating the CVFDT with an efficient resampling technique to address the issue of the class imbalanced data. The iCVFDT classification technique enjoys the advantages of CVFDT (such as stability), and at the same time, is not sensitive to imbalanced data. We captured the Internet traffic at a main gateway and prepared a real data stream with 3.5 million examples to which the iCVFDT classification technique was applied. The experimental results demonstrate a significant improvement in the performance of the iCVFDT compared to that of the CVFDT.