{"id":{"repo_id":"colo-mines","oai_identifier":"oai:repository.mines.edu:11124/178608"},"canonical_url":"https://search.dev.ndltd.org/etd/colo-mines/oai:repository.mines.edu:11124/178608","repository":{"repo_id":"colo-mines","name":"Colorado School of Mines","base_url":"https://repository.mines.edu/server/oai/request"},"display":{"title":"Machine learning for network traffic classification under labeled data and training time constraints","abstract":"This thesis investigates using machine learning (including deep learning) for network traffic classification when constrained by too little labeled data or insufficient time to train models from scratch. Network traffic classification is essential in network security, network management, and application identification. Labeling network traffic data, however, is often time-consuming and expensive, which limits the amount of labeled data available for training machine learning models. This thesis investigates using a semi-supervised learning approach that leverages positively labeled and unlabeled data to improve classification performance when faced with a lack of labeled data. The method uses a combination of bootstrap aggregation and tree-based classifiers to classify unlabeled network traffic flows from the same class successfully. This same semi-supervised learning approach also successfully detects zero-day (i.e., never before seen) encrypted messaging applications for which no training data is available. Additionally, this thesis investigates using deep transfer learning from a state-of-the-art computer vision model for network traffic image classification. By representing network traffic flows as grayscale network traffic images, highly sophisticated image classification models can transfer to the task of network traffic classification. Using these advanced models as a source for training dramatically enhances the speed at which new models can train, addressing the constraint of having too little time for training. To investigate whether deep transfer learning is successful in network traffic image classification, this work used our network flow capture system (which creates a volume of unlabeled data) and commercial appliances (to turn the unlabeled dataset into a real-world labeled dataset). Experimental results in this thesis demonstrate that the semi-supervised learning technique of positive and unlabeled learning is highly effective at detecting hidden positives amongst unlabeled data. Furthermore, this thesis shows that representing network traffic flows as grayscale images allows state-of-the-art image classification models (e.g., ResNet) to transfer to the domain of network traffic classification effectively.","abstract_html":"This thesis investigates using machine learning (including deep learning) for network traffic classification when constrained by too little labeled data or insufficient time to train models from scratch. Network traffic classification is essential in network security, network management, and application identification. Labeling network traffic data, however, is often time-consuming and expensive, which limits the amount of labeled data available for training machine learning models. This thesis investigates using a semi-supervised learning approach that leverages positively labeled and unlabeled data to improve classification performance when faced with a lack of labeled data. The method uses a combination of bootstrap aggregation and tree-based classifiers to classify unlabeled network traffic flows from the same class successfully. This same semi-supervised learning approach also successfully detects zero-day (i.e., never before seen) encrypted messaging applications for which no training data is available. Additionally, this thesis investigates using deep transfer learning from a state-of-the-art computer vision model for network traffic image classification. By representing network traffic flows as grayscale network traffic images, highly sophisticated image classification models can transfer to the task of network traffic classification. Using these advanced models as a source for training dramatically enhances the speed at which new models can train, addressing the constraint of having too little time for training. To investigate whether deep transfer learning is successful in network traffic image classification, this work used our network flow capture system (which creates a volume of unlabeled data) and commercial appliances (to turn the unlabeled dataset into a real-world labeled dataset). Experimental results in this thesis demonstrate that the semi-supervised learning technique of positive and unlabeled learning is highly effective at detecting hidden positives amongst unlabeled data. Furthermore, this thesis shows that representing network traffic flows as grayscale images allows state-of-the-art image classification models (e.g., ResNet) to transfer to the domain of network traffic classification effectively.","abstract_has_math":false,"creators":["Hussey, Jason P."],"institution":"Colorado School of Mines. Arthur Lakes Library","degree_name":"Doctor of Philosophy (Ph.D.)","degree_level":"Doctoral","degree_discipline":"Computer Science","degree_department":null,"school":null,"contributors":[],"advisors":["Camp, Tracy","Stone, Kerri A."],"committee_chairs":[],"committee_members":["Bandyopadhyay, Soutir","Romig, Phillip Richardson","Wang, Hua"],"year":2023,"date_issued":"2023","date_published":"2023","updated_at":"2026-07-24T01:42:34Z","subjects":["computer network","deep learning","machine learning","network traffic classification","semi-supervised learning","transfer learning"],"languages":["eng","English"],"rights":["Copyright of the original work is retained by the author."],"rights_urls":[],"identifier_entries":[{"key":"dc:identifier","label":"Identifier","values":["T 9602"],"render_values":[{"text":"T 9602","href":null,"code":true}]}]},"links":{"outbound_url":"https://hdl.handle.net/11124/178608","outbound_label":"Handle","outbound_source":"dc:identifier.uri"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:contributor.advisor","label":"Advisor","values":["Camp, Tracy","Stone, Kerri A."]},{"key":"dc:contributor.committeemember","label":"Committee Member","values":["Bandyopadhyay, Soutir","Romig, Phillip Richardson","Wang, Hua"]},{"key":"dc:creator","label":"Author","values":["Hussey, Jason P."]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"dc:date.accessioned","label":"Dc Date Accessioned","values":["2023-12-01T23:17:25Z"]},{"key":"dc:date.available","label":"Dc Date Available","values":["2023-12-01T23:17:25Z"]},{"key":"dc:date.issued","label":"Date","values":["2023"]},{"key":"dc:publisher","label":"Institution","values":["Colorado School of Mines. Arthur Lakes Library"]},{"key":"dc:type","label":"Dc Type","values":["Text"]},{"key":"thesis:degree_discipline","label":"Discipline","values":["Computer Science"]},{"key":"thesis:degree_level","label":"Degree Level","values":["Doctoral"]},{"key":"thesis:degree_name","label":"Degree Name","values":["Doctor of Philosophy (Ph.D.)"]},{"key":"thesis:institution_name","label":"Thesis Institution Name","values":["Colorado School of Mines"]}]},{"id":"subjects_keywords","label":"Subjects and Keywords","entries":[{"key":"dc:subject","label":"Dc Subject","values":["computer network","deep learning","machine learning","network traffic classification","semi-supervised learning","transfer learning"]}]},{"id":"language_rights","label":"Language and Rights","entries":[{"key":"dc:language","label":"Dc Language","values":["English"]},{"key":"dc:language.iso","label":"Language (ISO)","values":["eng"]},{"key":"dc:rights","label":"Dc Rights","values":["Copyright of the original work is retained by the author."]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier","label":"Identifier","values":["Hussey_mines_0052E_12676.pdf","T 9602"]},{"key":"dc:identifier.uri","label":"Identifier URI","values":["https://hdl.handle.net/11124/178608"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description","label":"Description","values":["Includes bibliographical references.","2023 Summer."]},{"key":"dc:description.abstract","label":"Abstract","values":["This thesis investigates using machine learning (including deep learning) for network traffic classification when constrained by too little labeled data or insufficient time to train models from scratch. Network traffic classification is essential in network security, network management, and application identification. Labeling network traffic data, however, is often time-consuming and expensive, which limits the amount of labeled data available for training machine learning models. This thesis investigates using a semi-supervised learning approach that leverages positively labeled and unlabeled data to improve classification performance when faced with a lack of labeled data. The method uses a combination of bootstrap aggregation and tree-based classifiers to classify unlabeled network traffic flows from the same class successfully. This same semi-supervised learning approach also successfully detects zero-day (i.e., never before seen) encrypted messaging applications for which no training data is available. Additionally, this thesis investigates using deep transfer learning from a state-of-the-art computer vision model for network traffic image classification. By representing network traffic flows as grayscale network traffic images, highly sophisticated image classification models can transfer to the task of network traffic classification. Using these advanced models as a source for training dramatically enhances the speed at which new models can train, addressing the constraint of having too little time for training. To investigate whether deep transfer learning is successful in network traffic image classification, this work used our network flow capture system (which creates a volume of unlabeled data) and commercial appliances (to turn the unlabeled dataset into a real-world labeled dataset). Experimental results in this thesis demonstrate that the semi-supervised learning technique of positive and unlabeled learning is highly effective at detecting hidden positives amongst unlabeled data. Furthermore, this thesis shows that representing network traffic flows as grayscale images allows state-of-the-art image classification models (e.g., ResNet) to transfer to the domain of network traffic classification effectively."]},{"key":"dc:format.medium","label":"Dc Format Medium","values":["born digital","doctoral dissertations"]},{"key":"dc:title","label":"Title","values":["Machine learning for network traffic classification under labeled data and training time constraints"]}]}],"canonical_facts":{"dc:contributor.advisor":["Camp, Tracy","Stone, Kerri A."],"dc:contributor.committeemember":["Bandyopadhyay, Soutir","Romig, Phillip Richardson","Wang, Hua"],"dc:creator":["Hussey, Jason P."],"dc:date.accessioned":["2023-12-01T23:17:25Z"],"dc:date.available":["2023-12-01T23:17:25Z"],"dc:date.issued":["2023"],"dc:description":["Includes bibliographical references.","2023 Summer."],"dc:description.abstract":["This thesis investigates using machine learning (including deep learning) for network traffic classification when constrained by too little labeled data or insufficient time to train models from scratch. Network traffic classification is essential in network security, network management, and application identification. Labeling network traffic data, however, is often time-consuming and expensive, which limits the amount of labeled data available for training machine learning models. This thesis investigates using a semi-supervised learning approach that leverages positively labeled and unlabeled data to improve classification performance when faced with a lack of labeled data. The method uses a combination of bootstrap aggregation and tree-based classifiers to classify unlabeled network traffic flows from the same class successfully. This same semi-supervised learning approach also successfully detects zero-day (i.e., never before seen) encrypted messaging applications for which no training data is available. Additionally, this thesis investigates using deep transfer learning from a state-of-the-art computer vision model for network traffic image classification. By representing network traffic flows as grayscale network traffic images, highly sophisticated image classification models can transfer to the task of network traffic classification. Using these advanced models as a source for training dramatically enhances the speed at which new models can train, addressing the constraint of having too little time for training. To investigate whether deep transfer learning is successful in network traffic image classification, this work used our network flow capture system (which creates a volume of unlabeled data) and commercial appliances (to turn the unlabeled dataset into a real-world labeled dataset). Experimental results in this thesis demonstrate that the semi-supervised learning technique of positive and unlabeled learning is highly effective at detecting hidden positives amongst unlabeled data. Furthermore, this thesis shows that representing network traffic flows as grayscale images allows state-of-the-art image classification models (e.g., ResNet) to transfer to the domain of network traffic classification effectively."],"dc:format.medium":["born digital","doctoral dissertations"],"dc:identifier":["Hussey_mines_0052E_12676.pdf","T 9602"],"dc:identifier.uri":["https://hdl.handle.net/11124/178608"],"dc:language":["English"],"dc:language.iso":["eng"],"dc:publisher":["Colorado School of Mines. Arthur Lakes Library"],"dc:rights":["Copyright of the original work is retained by the author."],"dc:subject":["computer network","deep learning","machine learning","network traffic classification","semi-supervised learning","transfer learning"],"dc:title":["Machine learning for network traffic classification under labeled data and training time constraints"],"dc:type":["Text"],"thesis:degree_discipline":["Computer Science"],"thesis:degree_level":["Doctoral"],"thesis:degree_name":["Doctor of Philosophy (Ph.D.)"],"thesis:institution_name":["Colorado School of Mines"]},"updated_at":"2026-07-24T01:42:34Z"}