To solve the problem of network traffic identification online, a clustering algorithm and a traffic identification scheme is proposed. The scheme uses a few number of the initial data packets in the flows as a subflow, extracts the statistical features from subflows, and extracts the best feature subset of subflows by applying correlationbased filter approach. The network traffic flows are clustered by online density based spatial clustering of applications with noise algorithm, and mapped to application types by the dominant application in clusters. Experiments show that the scheme can identify new application types and encrypted flows, and can be implemented in online network traffic classification.
 Callado A, Kamienski C, Szabo G. A survey on Internet traffic identification [J]. IEEE Communications Surveys and Tutorials, 2009, 11(3): 37-52.<br> Sen S, Spatscheck O, Wang Dongmei. Accurate, scalable in network identification of P2P traffic using application signatures //WWW2004. NY: IEEE Press, 2004: 512-521.<br> 马永立, 钱宗珏, 寿国础, 等. 机器学习用于网络流量识别[J]. 北京邮电大学学报, 2009, 32(1): 65-68. Ma Yongli, Qian Zongjue, Shou Guochu, et al. Network flow identification based on machine learning [J]. Journal of Beijing University of Posts and Telecommunications, 2009, 32(1): 65-68.<br> Karagiannis T, Papagiannaki D, Faloutsos M. Blinc: multilevel traffic classification in the dark [J]. Computer Communication Review, 2005, 35(4): 229-240.<br> 李卫, 边江, 王盈. 动态网络流分类研究[J]. 电子科 技大学学报, 2007, 36(6): 1508-1511. Li Wei, Bian Jiang, Wang Ying. Research on dynamic network flow classification [J]. Journal of University of Electronic Science and Technology of China, 2007, 36(6): 1508-1511.<br> Erman J, Arlitt M, Mahanti A. Traffic classification using clustering algorithms//SIGCOMM’06 MineNet Workshop. Pisa: ACM, 2006: 11-15.<br> Moore A, Papagiannaki K. Toward the accurate identification of network applications//PAM 2005. Boston: Springer-Verlag, 2005: 41-54.<br> Bernaille L, Teixeira R, Akodkenou I, et al. Traffic classification on the fly [J]. ACM SIGCOMM Computer Communication Review, 2006, 36(2): 231-236.