Network data traffic rating is one of the most important and complex tasks in the field of modern network engineering, with several basic functions such as bandwidth management, service quality control (QOS), resource allocation between different applications, as well as detecting malicious or unwanted activities within network. Historic systems have relied on two main methods: Port-Based Classification and Deep Packet Inspection - DPI. However, both methods faced fundamental restrictions with the development of the Internet; The propagation of dynamic ports and applications that hide behind non-standard ports has weakened the reliability of port-based classification [1]. While the package checking content has become practically unavailable with the widespread spread of encryption protocols such as TLS and HTTPS, which are now covering the vast majority of global Internet traffic [2] [3].

With these challenges, machine learning has emerged as a promising alternative based on the extraction of statistical properties from data movement (such as package lengths, intervals between their arrival, flow duration, and the number of bytes transferred) without the need for Read the actual package content or exclusive dependence on the port number. Recent studies have proven that this approach is capable of achieving high classification accuracy even in the presence of fully encrypted data traffic [4][5][6], which has made it an active and continuous subject of research in recent years.

This research aims to provide an integrated application study that is not limited to the literature review, but includes an actual design and implementation of a complete data processing and classification pipeline, from the definition of properties, through pretreatment, and ending with the training of four. Automated learning models that are commonly used in this field, and are evaluated in comparison with multiple performance standards.

Specifically, this research seeks to answer the following research questions:

• How effective are the flow-based features in distinguishing different data traffic?

The structure of this research is divided into six main sections: the second section reviews the relevant work, and the third section presents the proposed methodology, including the description of data, characteristics and classification algorithms. It will discuss it, and the sixth section concludes with the most important future conclusions and recommendations.

2. Related Work

AZAB and others [1] presented a comprehensive survey that compiled networks movement classification techniques and data sets, and discussed in-depth the challenges related to the diversity of protocols and cargo encryption. On the other hand, Lopez-Martin et al. [7] reviewed the deep learning applications in network traffic control and analysis (NTMA), with a special focus on the comparison between precision and computational complexity in actual production environments.

In more recent work, Feng et al. [3] provided a detailed survey of fine-grained internet traffic analysis techniques, discussing the limitations of traditional statistical methods in the face of the rapidly growing diversity of modern applications.

In the context of combining machine learning with Software-Defined Networking (SDN), Serag et al. [8] and Salau and Beyene [9] presented two applied studies which employed algorithms like AdaBoost, random forests, decision trees, logistic regression and SVM for classify protocols such as Telnet, DNS and Voice within an SDN environment; meanwhile, Sobh et al. [10] proposed a similar model aimed at improving Quality of Service (QoS) via scenarios of binary and multi-class classification, compared to linear, non-linear, and hybrid models.

Regarding deep learning contexts for encrypted traffic classification, Shi et al. [5] proposed the BFCN model, which integrates representations of BERT with Convolutional Neural Networks (CNNs). Meanwhile, Elshewey and Osman [6] produced a stacked deep ensemble framework combining GRUs, CNNs, RNNs, DNNs and LSTMs to classify encrypted HTTPS traffic, achieving an accuracy exceeding 99%. Additionally, Eslami and Hamouda [11] produced a hybrid framework leveraging self-supervised learning and confident learning for reduce reliance on manually classified data; this framework was evaluated on well-known datasets, including ISCX VPN-nonVPN.

In a recent comparative study, Antari et al. [4] employed classical models

(Random Forest, XGBoost, Decision Tree) alongside a Transformer model and large language models (Gemini, GPT-4o); the results produced the superiority of the Transformer model, achieving an accuracy of 98.95%. Meanwhile, Saqib et al. [12] proposed an in-network adaptive classifier aimed at reducing misclassification rates to enhance Quality of Service (QoS). Finally, Pekár et al. [13] proposed a comprehensive tutorial on building systems of flow-based classification, feature engineering, steps of covering flow measurement and leakage-resistant experimental design which largely informed the methodology of the current study.

In a context similar to the current application, Alshammari and Aleroud [14] compared between Random Forest, Decision Tree, KNN and SVM algorithms to classifying network traffic of smart city; they concluded that the Decision Tree algorithm outperformed the others with an accuracy of 99.18%, providing a direct point of comparison with the results of this research.

The current search for these works is distinguished by its focus on building a complete and reproductable application tube, with a systematic comparison of four algorithms within a standardized experimental environment and multiple evaluation criteria (accuracy, weighted accuracy, and recall. F1 score, cross-check, rather than just displaying individual results or purely literary review.

This section describes the applied methodology of the research, which consists of four sequential stages: (a) the description of the flow data set, (b) the extraction of statistical properties, (c) the pre-processing of the data, (d) the selection of classification algorithms and criteria evaluation.

3.1 Dataset Description

Due to the limitations of access to the Internet within the implementation environment of this search, it is not possible to download popular reference datasets such as ISCX VPN-Nonvpn [11] or CICIDS2017 directly.

To avoid a theoretical presentation, a simulated flow dataset was built statistically calibrate to mimic the properties of actual data movement documented in reference literature [1][14][7] For each of the six categories of applications; The average and standard deviation of each property (such as beam length, flow duration, and beam interval) were determined based on the values reported in those studies of each application type, with NOISE and deliberate interference between Items to avoid getting a simplified and unrealistic rating task. Table 1 shows the distribution of the six items used.

5.1 Comparative Performance Results

Table 3 presents the quantitative assessment results of all four models on the independent testing group, along with the average and cross-verification accuracy (5-fold) on training data.

This research provided an integrated applied study of network data traffic rating using machine learning techniques, including an actual design and implementation of a complete data processing pipeline, from the extraction of nine statistical flow properties, to pre-processing. And ending with training and evaluation of four classification models (Decision Tree, Random Forest, SVM, KNN). The results showed that the random jungle model had a 97.87% resolution and a similar F1 score, with high cross-verification stability, while the KNN algorithm achieved the lowest relative performance due to its sensitivity to the overlap between the statistically convergent cultivars such as VoIP and Gaming.

These results confirm that the statistical properties extracted from the flow level constitute an effective and applicable alternative to categorizing the movement of data, even in the absence of the ability to read the package, which makes this approach particularly suitable for the environments of modern networks. It is dominated by encryption protocols. To complete this work in the future, the researcher recommends the following:

1)) Validation of results obtained on real reference datasets such as ISCX VPN-NonvPN [11] and CICIDS2017, to ensure the ability to generalize the movement of actual networks.

2)) Expanding the study to include a larger number of application varieties, including IoT and SDN.

3)) Explore deep learning models (CNN, LSTM, Transformer) and compare them with the classic models used in this research, especially in dealing with the entire encrypted data movement.

4)) Study the performance of the proposed models in a real-time/online classification, rather than the post-Full Classification.