### 数学代写|理论计算机代写theoretical computer science代考| Evaluation

statistics-lab™ 为您的留学生涯保驾护航 在代写理论计算机theoretical computer science方面已经树立了自己的口碑, 保证靠谱, 高质且原创的统计Statistics代写服务。我们的专家在代写理论计算机theoretical computer science代写方面经验极为丰富，各种代写理论计算机theoretical computer science相关的作业也就用不着说。

• Statistical Inference 统计推断
• Statistical Computing 统计计算
• (Generalized) Linear Models 广义线性模型
• Statistical Machine Learning 统计机器学习
• Longitudinal Data Analysis 纵向数据分析
• Foundations of Data Science 数据科学基础

## 数学代写|理论计算机代写theoretical computer science代考|Dataset

To evaluate the proposed framework, we have fully implemented it and have run multiple experiments. We evaluate our method for two classification tasks: traffic characterization and application identification. Traffic characterization deals with determining the application category of a trace such as Chat, and the goal of application identification is to distinguish the application of a trace such as Skype. To evaluate the performance of the proposed framework, we have used Precision (Pr), Recall (Rc), and F1-Measure (F1). The mathematical formula for these metrics is provided in Eq. 4 .
$$\text { Recall }=\frac{T P}{T P+F N}, \text { Precision }=\frac{T P}{T P+F P}, F 1=\frac{2 * R c * P r}{R c+P r}$$

We have fully implemented the framework with Python 3. After filtering out the unnecessary packets, 5 -tuple which identifies each network flow along with timestamp and length are extracted for each packet of packet trace. Statistical features provided in Table 1 are extracted by Python Pandas libraries ${ }^{2}$ in the Network Unit Extraction module (Sect. 4.1). Kmeanst+ algorithm is used for the clustering purpose from the scikit-learn library ${ }^{3}$ and StandardScaler function is used for standardizing the feature sets from the same package in the Network Unit Clustering module (Sect. 4.1). To automate identifying the number of clusters of each protocol, we have leveraged KneeLocator from the Kneed library ${ }^{4}$. For implementing the Language Learner module (Sect. 4.2) we benefited from k-TSS language learner part of [11] implementation and modified it based on our purpose. Finally, we have used the grid search method to choose the best value for the framework’s hyper-parameters, including $s t, i t, f d$, stats, and $k$.

## 数学代写|理论计算机代写theoretical computer science代考|Classification Results

We have used a grid search to fine-tune the parameters $s t, f d$, it, stats, and $k$, called hyper-parameters in machine learning. Based on the average F1-Measure, consequently, the best values for the application identification task are $15 \mathrm{~s}, 5 \mathrm{~s}$, $10 \mathrm{~s}, 2$, and 3 for the hyper-parameters $s t, f d$, it, stats, and $k$, respectively, while for the traffic characterization task, they are $15 \mathrm{~s}, 15 \mathrm{~s}, 10 \mathrm{~s}, 2$, and 3 . Using the elbow method, the number of clusters for the most used protocol such as TCP is automatically set to 23 and for a less used protocol such as HTTP is set to six, resulting in 101 total number of clusters.

We have evaluated the framework on the test set with the chosen hyperparameters. The framework has gained weighted average F1-Measure of $97 \%$ for both tasks. Table 2 provides the proposed framework performance in terms of Precision, Recall, and F1-Measure in detail. In this section, we provide a comparison of our framework with other flow-based methods used for network traffic classification. For the application identification task, we have compared our work with [2]. In this comparison, we first have extracted 44 most used statistical flow-based features from the dataset, as the 111 initial features are not publicly available. Then, we have converted these instances to arff format to be used as Weka ${ }^{5}$ input. To have a fair comparison, we have used the ChiSquaredAttributeEval evaluator for feature selection and finally, applied all machine learning algorithms, including J48, Random Forest, $\mathrm{k}-\mathrm{NN}(\mathrm{k}=1)$, and Bayes Net with 10 fold cross-validation used in this work. Figure 4 a compares the proposed framework performance with [2] in terms of Precision, Recall, and F1-Measure for application identification task. In most

classes, our framework performed considerably better. Our framework gains much higher precision in identification of different applications in our dataset except for TeamViewer and JoinMe. In terms of recall, the work of [2] performed slightly better in detecting JoinMe and Ultra.

For the traffic characterization task, we made a comparison with the work of [1]. We have implemented a python code to extract time-related statistical flow-based features used by the authors. Using Weka, we have applied KNN and C4.5 in a 10-fold cross-validation setting which is the same as the one used in the paper. Figure $4 \mathrm{~b}$ compares the proposed framework performance with these

machine learning algorithms in terms of Precision, Recall, and F1-Measure for the traffic characterization task, showing that our work significantly outperforms the state-of-the-art work in application identification task.

As the proposed method in [7] is the only framework that has leveraged automata learning methods for application identification, we compare our work with it in terms of performance and time complexity (Table 3). Although the performance of [7] was computed in a two-class classification setting, NeTLang almost outperforms it in terms of Recall and F1-Measure. However, [7] has achieved higher overall precision because of its automata learning nature but owns time-consuming training and testing processes, while NeTLang considerably reduces the training time to the scale of minutes and it identifies application by observing only $4 k$ of a network trace.

## 数学代写|理论计算机代写theoretical computer science代考|Related Work

Machine Learning Based Methods in Traffic Classification. Many researchers applied the machine learning techniques in traffic classification. Time-related statistical flow-based features are used in [1] to characterize traffic in the presence/absence of a virtual private network (VPN). In this work, C4.5 decision tree and K-Nearest Neighbors are applied to the extracted features to classify flows. According to their result, the C4.5 algorithm performed better with the precision of $90 \%$ for traffic characterization.

Application identification from network flows is another traffic classification task performed in [2]. They used the CfsSubsetEval and ChiSquaredAttributeEval methods in Weka to optimize the number of features and supervised learning algorithms, including J48, Random Forest, k-NN, and Bayes Net. For the dataset they used, Random Forest and $\mathrm{k}$-NN had better performance in terms of accuracy $(90.87 \%$ and $93.94 \%$, respectively).

Deep Packet [3] is a recently proposed packet-level deep-learning-based framework that automatically extracts features for traffic classification. They used stacked autoencoders and one-dimensional CNN in their framework. This framework achieved a recall of $94 \%$ and $98 \%$ for traffic characterization and application identification tasks, respectively. The drawback of the deep-learningbased method is their time-consuming training process.

Automata Learning Based Methods in Traffic Classification. The most related work to ours is [7] in terms of utilizing a passive automata learning technique to derive the behavioral packet-level network models of applications. They provided a multi-steps algorithm consists of building an initial automaton and generalizing it by a state merging condition based on the behavior of well-known network protocols. Their fine granularity leads to produce large models, which make some steps of generalizing fulfill slowly for large models. Furthermore, the detection of an application was constrained to observing a complete trace of an application. Our method rectifies these shortcomings by the idea of learning a k-TSS language, which was inspired by [11]. Botnet detection has been studied in [8]. They passively learned automata for clusters of the dataset to characterize a communication profile. Other related work mainly use the automata learning for protocol modeling such as $[9,10]$ by active automata learning, while using the desired protocol implementation as their oracle system and alphabet of the automaton derived manually by an expert.

## 数学代写|理论计算机代写theoretical computer science代考|Dataset

记起 =吨磷吨磷+Fñ, 精确 =吨磷吨磷+F磷,F1=2∗RC∗磷rRC+磷r

## 数学代写|理论计算机代写theoretical computer science代考|Related Work

Deep Packet [3] 是最近提出的基于数据包级深度学习的框架，可自动提取特征进行流量分类。他们在他们的框架中使用了堆叠的自动编码器和一维 CNN。该框架实现了召回94%和98%分别用于流量表征和应用识别任务。基于深度学习的方法的缺点是训练过程耗时。

## 有限元方法代写

tatistics-lab作为专业的留学生服务机构，多年来已为美国、英国、加拿大、澳洲等留学热门地的学生提供专业的学术服务，包括但不限于Essay代写，Assignment代写，Dissertation代写，Report代写，小组作业代写，Proposal代写，Paper代写，Presentation代写，计算机作业代写，论文修改和润色，网课代做，exam代考等等。写作范围涵盖高中，本科，研究生等海外留学全阶段，辐射金融，经济学，会计学，审计学，管理学等全球99%专业科目。写作团队既有专业英语母语作者，也有海外名校硕博留学生，每位写作老师都拥有过硬的语言能力，专业的学科背景和学术写作经验。我们承诺100%原创，100%专业，100%准时，100%满意。

## MATLAB代写

MATLAB 是一种用于技术计算的高性能语言。它将计算、可视化和编程集成在一个易于使用的环境中，其中问题和解决方案以熟悉的数学符号表示。典型用途包括：数学和计算算法开发建模、仿真和原型制作数据分析、探索和可视化科学和工程图形应用程序开发，包括图形用户界面构建MATLAB 是一个交互式系统，其基本数据元素是一个不需要维度的数组。这使您可以解决许多技术计算问题，尤其是那些具有矩阵和向量公式的问题，而只需用 C 或 Fortran 等标量非交互式语言编写程序所需的时间的一小部分。MATLAB 名称代表矩阵实验室。MATLAB 最初的编写目的是提供对由 LINPACK 和 EISPACK 项目开发的矩阵软件的轻松访问，这两个项目共同代表了矩阵计算软件的最新技术。MATLAB 经过多年的发展，得到了许多用户的投入。在大学环境中，它是数学、工程和科学入门和高级课程的标准教学工具。在工业领域，MATLAB 是高效研究、开发和分析的首选工具。MATLAB 具有一系列称为工具箱的特定于应用程序的解决方案。对于大多数 MATLAB 用户来说非常重要，工具箱允许您学习应用专业技术。工具箱是 MATLAB 函数（M 文件）的综合集合，可扩展 MATLAB 环境以解决特定类别的问题。可用工具箱的领域包括信号处理、控制系统、神经网络、模糊逻辑、小波、仿真等。