Fine-Grained Behavioral Classification in the Core: The Issue of Flow Sampling
This work studies the impact of flow sampling on the accuracy of behavioral traffic classification. More precisely, the authors consider the case where the traffic classification engine is located at different vantage points of the network. Usually, behavioral classification is performed close to the user access network - where all the traffic exchanged by an endpoint can be observed. In this work instead they take into account the case of a classifier placed deeper in the aggregation network - where, due to load balancing or routing issues, only part of the traffic is generally observed.