Clustering-based separation of media transfers in DPI-classified cellular video and VoIP traffic

摘要

Identifying VoIP and video traffic is often useful in the context of managing a cellular network, and to perform such traffic classification deep packet inspection (DPI) approaches are often used. Commercial DPI classifiers do not necessarily differentiate between, for example, YouTube traffic that arises from browsing inside the YouTube app, and traffic arising from the actual viewing of a YouTube video. Here we apply unsupervised clustering methods on such cellular DPI-labeled VoIP and video traffic to identify the characteristic behavior of the two sub-groups of media-transfer and non media-transfer flows. The analysis is based on a measurement campaign performed inside the core network of a commercial cellular operator, collecting data for more than two billion packets in 40+ million flows. A specially instrumented commercial DPI appliance allows the simultaneous collection of per packet information in addition to the DPI classification output. We show that the majority of flows falls into clusters that are easily identifiable as belonging to one of the traffic sub-groups, and that a surprising majority of DPIlabeled VoIP and video traffic is non-media related.