# Active Learning for Network Traffic Classification: A Technical Study

arXiv: https://arxiv.org/abs/2106.06933 · HTML: https://mlsanity.com/paper/2106.06933/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 17 of its 124 references that are in the map.
- First posted on arXiv 13 Jun 2021.

## Builds on (most cited first, 17 of 17)

- [A Survey of Deep Active Learning](https://mlsanity.com/paper/2009.00236/) (2020)
- [Learning Active Learning from Data](https://mlsanity.com/paper/1703.03365/) (2017)
- [D"IoT: A Federated Self-learning Anomaly Detection System for IoT](https://mlsanity.com/paper/1804.07474/) (2018)
- [A Survey of Network-based Intrusion Detection Data Sets](https://mlsanity.com/paper/1903.02460/) (2019)
- [Federated Learning for Malware Detection in IoT Devices](https://mlsanity.com/paper/2104.09994/) (2021)
- [Application of Machine Learning in Wireless Networks: Key Techniques and Open Issues](https://mlsanity.com/paper/1809.08707/) (2018)
- [Deep Learning for Encrypted Traffic Classification: An Overview](https://mlsanity.com/paper/1810.07906/) (2018)
- [A Method for Stopping Active Learning Based on Stabilizing Predictions and the Need for User-Adjustable Stopping](https://mlsanity.com/paper/1409.5165/) (2014)
- [Active Learning for Wireless IoT Intrusion Detection](https://mlsanity.com/paper/1808.01412/) (2018)
- [How to Achieve High Classification Accuracy with Just a Few Labels: A Semi-supervised Approach Using Sampled Packets](https://mlsanity.com/paper/1812.09761/) (2018)
- [Better Data Labelling with EMBLEM (and how that Impacts Defect Prediction)](https://mlsanity.com/paper/1905.01719/) (2019)
- [Deep Active Learning for Anomaly Detection](https://mlsanity.com/paper/1805.09411/) (2018)
- [A Survey on Big Data for Network Traffic Monitoring and Analysis](https://mlsanity.com/paper/2003.01648/) (2020)
- [Stopping Active Learning based on Predicted Change of F Measure for Text Classification](https://mlsanity.com/paper/1901.09118/) (2019)
- [Mockingbird: Defending Against Deep-Learning-Based Website Fingerprinting Attacks with Adversarial Traces](https://mlsanity.com/paper/1902.06626/) (2019)
- [Deciding when to stop: Efficient stopping of active learning guided drug-target prediction](https://mlsanity.com/paper/1504.02406/) (2015)
- [Machine Learning for Intelligent Optical Networks: A Comprehensive Survey](https://mlsanity.com/paper/2003.05290/) (2020)

## Built on by (most cited first, 5 of 5)

- [Fine-grained TLS services classification with reject option](https://mlsanity.com/paper/2202.11984/) (2022)
- [Is margin all you need? An extensive empirical study of active learning on tabular data](https://mlsanity.com/paper/2210.03822/) (2022)
- [FlowWise: Stateful Fast-Slow Model Serving for Streaming Traffic Intelligence](https://mlsanity.com/paper/2402.03694/) (2024)
- [Active Learning Framework to Automate NetworkTraffic Classification](https://mlsanity.com/paper/2211.08399/) (2022)
- [Cognitive Graph Intelligence for Adaptive and Robust DDoS Attack Detection in Next Generation Networks](https://mlsanity.com/paper/2608.17352/) (2026)

## Abstract (arXiv)

Network Traffic Classification (NTC) has become an important feature in various network management operations, e.g., Quality of Service (QoS) provisioning and security services. Machine Learning (ML) algorithms as a popular approach for NTC can promise reasonable accuracy in classification and deal with encrypted traffic. However, ML-based NTC techniques suffer from the shortage of labeled traffic data which is the case in many real-world applications. This study investigates the applicability of an active form of ML, called Active Learning (AL), in NTC. AL reduces the need for a large number of labeled examples by actively choosing the instances that should be labeled. The study first provides an overview of NTC and its fundamental challenges along with surveying the literature on ML-based NTC methods. Then, it introduces the concepts of AL, discusses it in the context of NTC, and review the literature in this field. Further, challenges and open issues in AL-based classification of network traffic are discussed. Moreover, as a technical survey, some experiments are conducted to show the broad applicability of AL in NTC. The simulation results show that AL can achieve high accuracy with a small amount of data.