Modeling network traffic is an endeavor actively carried on since early digital communications, supporting a number of practical applications, that range from network planning and provisioning to security. Accordingly, many theoretical and empirical approaches have been proposed in this long-standing research, most notably, Machine Learning (ML) ones. Indeed, recent interest from network equipment vendors is sparking around the evaluation of solid information-theoretical modeling approaches complementary to ML ones, especially applied to new network traffic profiles stemming from the massive diffusion of mobile apps. To cater to these needs, we analyze mobile-app traffic available in the public dataset MIRAGE-2019 adopting two related modeling approaches based on the well-known methodological toolset of Markov models (namely, Markov Chains and Hidden Markov Models ). We propose a novel heuristic to reconstruct application-layer messages in the common case of encrypted traffic. We discuss and experimentally evaluate the suitability of the provided modeling approaches for different tasks: characterization of network traffic (at different granularities, such as application, application category, and application version), and prediction of network traffic at both packet and message level. We also compare the results with several ML approaches, showing performance comparable to a state-of-the-art ML predictor (Random Forest Regressor). Also, with this work we provide a viable and theoretically sound traffic-analysis toolset to help improving ML evaluation (and possibly its design), and a sensible and interpretable baseline.

中文翻译：

---

使用马尔可夫模型描述和预测移动应用流量


网络流量建模是自早期数字通信以来就积极进行的一项工作，支持从网络规划和配置到安全性的许多实际应用。因此，在这项长期研究中提出了许多理论和实证方法，尤其是机器学习（ML）方法。事实上，网络设备供应商最近对评估与机器学习方法互补的可靠信息理论建模方法产生了兴趣，特别是应用于移动应用程序大规模传播所产生的新网络流量配置文件。为了满足这些需求，我们采用基于众所周知的马尔可夫模型方法工具集（即马尔可夫链和隐马尔可夫模型）的两种相关建模方法来分析公共数据集 MIRAGE-2019 中可用的移动应用程序流量。我们提出了一种新颖的启发式方法来在加密流量的常见情况下重建应用层消息。我们讨论并通过实验评估所提供的建模方法对不同任务的适用性：网络流量的表征（在不同的粒度，例如应用程序、应用程序类别和应用程序版本）以及数据包和消息级别的网络流量预测。我们还将结果与几种 ML 方法进行了比较，显示其性能可与最先进的 ML 预测器（随机森林回归器）相媲美。此外，通过这项工作，我们提供了一个可行且理论上合理的流量分析工具集，以帮助改进机器学习评估（可能还有其设计），以及合理且可解释的基线。