Identifying Known and Unknown Mobile Application Traffic Using a Multilevel Classifier

Table 1

Traffic feature set.

Feature	Description	Number
Payload size related	the first three non-null payload size of the packets transmitted from the client to the server; the first and third non-null payload size of the packets transmitted from the server to the client	5
Packet length related	maximum, minimum of the length of the packets transmitted from the client to the server; maximum, minimum, average, variance of the length of the packet transmitted from the server to the client; the minimum packet length of the flow	7
First 16 bytes of payload	a symbol is used to preserve the transmission direction	16
Destination port		1