The daily deployment of new applications, along with the exponential increase in network traffic, entails a growth in the complexity of network analysis and monitoring. Conversely, the increasing availability and decreasing cost of computational capacity have increased the popularity and usability of machine learning algorithms. In this paper, a system for classifying user activities from network traffic using both supervised and unsupervised learning is proposed. The system uses the behaviour exhibited over the network and classifies the underlying user activity, taking into consideration all of the traffic generated by the user within a given time window. Those windows are characterised with features extracted from the network and transport layer headers in the traffic flows. A three-layer model is proposed to perform the classification task. The first two layers of the model are implemented using K-Means, while the last one uses a Random Forest to obtain the activity labels. An average accuracy of 97.37% is obtained, with values of precision and recall that allow online classification of network traffic for Quality of Service (QoS) and user profiling, outperforming previous proposals.

新应用程序的每日部署以及网络流量的指数增长，导致网络分析和监控的复杂性不断增加。相反，计算能力的增加可用性和降低的成本增加了机器学习算法的流行度和可用性。本文提出了一种使用监督学习和非监督学习对用户流量和网络流量进行分类的系统。该系统使用网络上表现出的行为，并考虑到用户在给定时间范围内生成的所有流量，对基础用户活动进行分类。这些窗口的特征是从流量中的网络和传输层头中提取的特征。提出了一个三层模型来执行分类任务。该模型的前两层使用K均值实现，而最后一层使用随机森林来获取活动标签。获得的平均准确度为97.37％，其精确度和召回率值允许对网络流量进行在线分类以实现服务质量（QoS）和用户配置文件，优于以前的建议。