[Paper Review] Elephant Flows Detection Using Deep Neural Network, Convolutional Neural Network, Long Short Term Memory and Autoencoder

Getahun Wassie Geremew, Jianguo Ding|arXiv (Cornell University)|Jun 6, 2023

Internet Traffic Analysis and Secure E-voting4 citations

TL;DR

This paper proposes a deep learning-based dynamic traffic classifier using DNN, CNN, LSTM, and autoencoder models to detect elephant flows—high-bandwidth network flows that cause congestion. The models achieve high accuracy (up to 99.12%) and low reconstruction loss (0.13), demonstrating effectiveness in identifying bandwidth-hogging flows without labeled data, especially via the autoencoder's unsupervised approach.

ABSTRACT

Currently, the wide spreading of real-time applications such as VoIP and videos-based applications require more data rates and reduced latency to ensure better quality of service (QoS). A well-designed traffic classification mechanism plays a major role for good QoS provision and network security verification. Port-based approaches and deep packet inspections (DPI) techniques have been used to classify and analyze network traffic flows. However, none of these methods can cope with the rapid growth of network traffic due to the increasing number of Internet users and the growth of real time applications. As a result, these methods lead to network congestion, resulting in packet loss, delay and inadequate QoS delivery. Recently, a deep learning approach has been explored to address the time-consumption and impracticality gaps of the above methods and maintain existing and future traffics of real-time applications. The aim of this research is then to design a dynamic traffic classifier that can detect elephant flows to prevent network congestion. Thus, we are motivated to provide efficient bandwidth and fast transmision requirements to many Internet users using SDN capability and the potential of Deep Learning. Specifically, DNN, CNN, LSTM and Deep autoencoder are used to build elephant detection models that achieve an average accuracy of 99.12%, 98.17%, and 98.78%, respectively. Deep autoencoder is also one of the promising algorithms that does not require human class labeler. It achieves an accuracy of 97.95% with a loss of 0.13 . Since the loss value is closer to zero, the performance of the model is good. Therefore, the study has a great importance to Internet service providers, Internet subscribers, as well as for future researchers in this area.

Motivation & Objective

• To address network congestion caused by elephant flows in high-bandwidth real-time applications like VoIP and video streaming.
• To overcome limitations of traditional port-based and DPI methods, which struggle with scalability and high network traffic volumes.
• To design a dynamic, scalable traffic classification system using deep learning for improved QoS and network security.
• To evaluate multiple deep learning architectures—DNN, CNN, LSTM, and autoencoder—for elephant flow detection.
• To explore unsupervised learning via autoencoder to eliminate dependency on human-labeled data.

Proposed method

• The study employs four deep learning models: Deep Neural Network (DNN), Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM), and Deep Autoencoder for elephant flow detection.
• Input features are derived from network flow statistics, such as packet counts, byte counts, and flow duration, used to train the models.
• The DNN, CNN, and LSTM models are trained in a supervised manner using labeled elephant flow data.
• The autoencoder model is trained in an unsupervised manner to reconstruct normal flows, with high reconstruction error indicating elephant flows.
• Model performance is evaluated using accuracy and reconstruction loss, with the autoencoder’s performance measured by its ability to detect anomalies based on reconstruction error.
• The models are evaluated on a real-world network dataset to assess their detection capability under realistic conditions.

Experimental results

Research questions

• RQ1 Can deep learning models effectively detect elephant flows in high-volume, real-time network traffic?
• RQ2 How do different deep learning architectures—DNN, CNN, LSTM, and autoencoder—compare in terms of detection accuracy and efficiency?
• RQ3 Can an unsupervised autoencoder model detect elephant flows without requiring labeled training data?
• RQ4 What is the impact of reconstruction loss on the autoencoder’s ability to identify high-bandwidth flows?
• RQ5 How do these models perform in maintaining low latency and high accuracy under dynamic network conditions?

Key findings

• The DNN model achieved the highest detection accuracy at 99.12%, demonstrating strong performance in classifying elephant flows.
• The CNN model achieved 98.17% accuracy, showing effectiveness in capturing spatial patterns in flow features.
• The LSTM model achieved 98.78% accuracy, highlighting its capability in modeling temporal dependencies in network flows.
• The autoencoder model achieved 97.95% accuracy with a low reconstruction loss of 0.13, indicating strong performance in unsupervised anomaly detection.
• The low reconstruction loss value (0.13) confirms that the autoencoder model effectively learns normal flow patterns and detects deviations as elephant flows.
• The study confirms that deep learning models, especially the autoencoder, offer a scalable and efficient solution for real-time elephant flow detection without reliance on labeled data.