Jielun Zhang，F(xiàn)uhao Li，F(xiàn)eng Ye*

Department of Electrical and Computer Engineering，University of Dayton，OH，45469，USA

*The corresponding author，email: fye001@udayton.edu

Abstract: Network traffic classification is essential in supporting network measurement and management.Many existing traffic classification approaches provide application-level results regardless of the network quality of service (QoS) requirements.In practice，traffic flows from the same application may have irregular network behaviors that should be identified to various QoS classes for best network resource management.To address the issues，we propose to conduct traffic classification with two newly defined QoSaware features，i.e.，inter-APP similarity and intra-APP diversity.The inter-APP similarity represents the close QoS association between the traffic flows that originate from the different Internet applications.The intra-APP diversity describes the QoS variety of the traffic even among those originated from the same Internet application.The core of performing the QoS-aware feature extraction is a Long-Short Term Memory neural network based Autoencoder (LSTMAE).The QoS-aware features extracted by the encoder part of the LSTM-AE are then clustered into the corresponding QoS classes.Real-life data from multiple applications are collected to evaluate the proposed QoS-aware network traffic classification approach.The evaluation results demonstrate the efficacy of the extracted QoS-aware features in supporting the traffic classification，which can further contribute to future network measurement and management.

Keywords: Network traffic clustering; quality-ofservice;quality-of-experience;deep learning

I.INTRODUCTION

With the increasing number of Internet applications and users in the past decades，it has become challenging to measure and manage networks effectively.The new emerging software-defined networks (SDN) has motivated the development of efficient network measurement and management schemes aiming the network optimization in the core network [1-3]，where features such as intrusion detection，network slicing，and network function virtualization enable secure dynamic network resource allocations to provide endusers with decent quality-of-experience (QoE) [4-8].In other words，end-to-end network quality-of-service(QoS) provisioning relies on accurate network measurement.Therefore，reliable network traffic classification (NTC) is necessary for preserving a relatively direct correlation between network QoS and the enduser QoE [9]，such that a QoS-aware NTC approach that can classify traffic into the corresponding QoS classes.

NTC is a process that automatically categorizes computer network traffic into a series of network traffic classes [9-17].Conventional NTC approaches classify network traffic based on the port assignments，deep packet inspection，and statistical approaches[11，12].They have been gradually phased out due to the implementation of network security mechanisms such as dynamic port assignment and traffic encryption.Instead，researchers have proposed statisticsbased NTC schemes，where Machine Learning (ML)algorithms such as logistic regression，support vector machine[13-16]are often used.The ML-based NTC schemes analyze network statistical attributes such as packet sizes，packet inter-arrival rate，latency，etc.，to provide effective network traffic classification.With the recent development of Deep Learning (DL) techniques，such as Multilayer Perceptron，Long Short-Term Memory Neural Network，Convolutional Neural Network [18-21] have been widely applied to build data-driven network traffic classifiers.DL-based NTC approaches process the content of packet header and payload directly and are capable of identifying encrypted network traffic [16，22].As diverse network QoS challenges precious network resources management，the determination of an optimal number of QoS classes is also critical.Few NTC approaches have considered network QoS during the classification.However，the QoS classes in the proposed works are manually defined in a subjective manner，and the number of QoS classes is fixed，which does not allow any QoS class extension[23，24].

Most of the existing DL-based NTC approaches are designed in application-level[16，18-22].Despite the fact that traffic originated from a specific application that may be assumed to belong to a corresponding QoS class，the actual network QoS requirements for even the same application may vary depending on network capability，user devices，and user preferences.For example，QoS requirements from the same online video streaming service can be different based on chosen video quality and the types of the steaming device.Therefore，different network behaviors from the same application can be diverse，yet similar network behaviors from various applications may share the same QoS classes[9].As a result，knowing the application alone may not provide accurate QoS awareness in network measurement and management.For example，network QoS requested by voice chatting and video chatting in Skype are undoubtedly different from each other.However，traffic originated from two different FTP download applications may belong to the same QoS class.In general，QoS-awareness during NTC is necessary to support networking.Although some literature have proposed NTC approaches with the consideration of network QoS，the QoS classes in those works are manually defined with a fixed numbers of QoS classes，which does not allow any QoS class extension[23，24].

To tackle these issues，we propose a novel NTC approach with QoS-awareness by treating network traffic as time series with multi-variants.Unlike the aforementioned DL-based and statistics-based NTC approaches，the QoS-aware NTC approach proposed in this work learns to classify traffic in an unsupervised manner.In specific，a Long Short-Term Memory Neural Network based Autoencoder (LSTM-AE) [25] is developed to extract temporal QoS representations according to network key performance indicators(KPIs)in time series[26].The temporal QoS representations are further processed for two newly defined features，i.e.，intra-APP diversity and inter-APP similarity.The intra-APP diversity captures distinct QoS characteristics from traffic flows of the same application，and the inter-APP similarity captures similar QoS characteristics from traffic that originated from different applications.The two features are considered jointly to provide QoS-aware traffic classification for network resource management.Besides，our proposed QoS class generation scheme can create QoS classes accordingly to adapt to the network environment as traffic QoS changes over time.To prove the effectiveness of the proposed NTC approach，data from real applications are collected to compose a dataset for the evaluation.The evaluation results demonstrate that the proposed QoS-aware NTC approach can successfully classify network traffic originated from different applications according to their QoS requirements.Our contributions in this paper can be concluded as: we have proposed an unsupervised traffic classification approach with QoS-awareness with two newly defined terms，intra-APP diversity and inter-APP similarity.A flexible number of QoS classes is allowed and can be generated autonomously to accommodate the changes of QoS requirements for different applications.

The rest of the paper is organized as follows.In Section II，we introduce related work about network traffic classification and network QoS.In Section III，we present the proposed QoS-aware network traffic classification approach.In Section IV，the evaluation results are demonstrated.In Section V，we conclude this research work.

II.RELATED WORK

2.1 Conventional NTC

Researchers have proposed various NTC approaches to support networking in the past few decades.Conventionally，port number information is used for simple traffic classification.The Internet Assigned Numbers Authority (IANA) had assigned transport-layer ports to network protocols [16].A port list with a given association between ports and the respective network services enables port-based NTC approaches to scan the port number directly through the packet header and match the packet with the corresponding protocol.However，with the implementation of dynamic port assignment and network address translation，port-based NTC approaches can hardly support the modern network.Payload-based NTC approaches perform payload inspection，e.g.，deep packet inspection，which was proposed as an alternative to portbased NTC approaches [16，27].They analyzed the contents in packet payloads and compare them with the protocol signatures in the database for traffic classification.Nonetheless，the payload contents in most packets nowadays are unreadable due to the adoption of encryption mechanisms for user privacy.

Recently，researchers have applied ML algorithms，e.g.，K-Means clustering，logistic regression，support vector machine [13-16]，as statistics-based NTC approaches for traffic classification，which commonly use statistical features such as packet size，inter-arrival time，etc.，for classification.Andersonet al.in [14]proposed to use a logistic regression algorithm for learning flow-level features，header information，and other features jointly to classify the encrypted traffic as either malware traffic or normal traffic.Saberet al.in[15]proposed to combine principal component analysis along with the support vector machine for traffic classification relying on only time-based flow features.

2.2 Deep Learning Based NTC

DL-based classification approaches have been widely studied in many research fields such as computer vision，natural language processing，etc.[18-21，28].Nonetheless，it is just adopted recently by a few researchers to build DL models with neural networks，e.g.，MLP，SAE，CNN，for traffic classification [21，22，27，29].Compared with port-based and payloadbased NTC approaches，DL-based NTC can provide accurate classification results consistently even when dynamic port assignment and traffic encryption are adopted.Besides，it does not require manual feature selection，which is essential in those statistics-based NTC approaches.Liet al.in[20]proposed a byte segment neural network，including an attention scheme that extracts features of payload segments individually and outputs classification results with a Softmaxclassification layer.Liuet al.in [21] developed FSNet based on recurrent neural networks and an autoencoder for both traffic classification and packet feature mining.Lotfollahiet al.in[29]and Wanget al.in [27] applied MLP，SAE，and CNN for traffic classification.They can provide high classification accuracy.However，these methods cannot differ the QoS of the network traffic and only provide application-level traffic classification.The classification results given by them are not helpful to support network resource management with QoS-awareness.

2.3 Network QoS and QoS-related NTC

Integrated Service (IntServ) [30] and Differentiated Services(DiffServ)are two QoS solutions to the current networking systems [31].IntServ reserves network resources to achieve QoS，where the routers follow the same policy to perform resource reservation.It consists of Flow Spec and Resource reservation protocol(RSVP).Flow Spec allows the application to request resource reservations from the routers at their demand.RSVP allows the requests to be sent and answered among the application and the routers.

DiffServ provides a scalable QoS control for network service providers by using Differentiated Services Code Point (DSCP) [32，33].In the Diff-Serv domain，a set of routers are defined with the same DiffServ policies，where interconnected Diff-Serv nodes follow the same policy and Per-hop behavior(PHB)[34].PHB defines the forwarding properties for the packets in different classes，and the packets in the DiffServ domain are first classified based on the assigned DSCP values.However，the DSCP only offers a bounded number of QoS classes due to the limited number of bits reserved in the packet header[35].Although the DSCP can directly tell rough QoS specifications，some applications that do not assign DSCP in their packets can not be benefited or correctly classified into the corresponding QoS classes for an optimal network resource allocation.

Although few NTC approaches that developed based on traffic statistics have considered network QoS during the classification [23，36，37]，the QoS classes and the number of QoS classes are defined manually and seldom get the update.For example，RFC 4594 [38] offers some specified service classes such as real-time interactive，multimedia streaming，high-throughput data，etc.，the number of classes is limited.Roughanet al.in [23] defined only four service classes such as interactive，bulk data transfer，streaming，and transactional，in their traffic classification approach.Yuet al.in [37] also defined only four QoS classes，i.e.，voice，video，bulk data，and interactive data，for their proposed QoS-aware traffic classification approach.Apparently，using manually defined QoS classes as the criteria is not optimal to classify network traffic with precious QoS awareness.Moreover，advancing network technologies and rising user demands have promoted more diverse network behaviors over time，such as higher and higher video qualities provided by online streaming applications.The new advanced QoS requirements from new emerging network behaviors require prompt updates in QoS classes.

III.METHODOLOGY

3.1 Overview Of the Proposed QoS-Aware Traffic Classification Approach

Our proposed QoS-aware traffic classification approach mainly relies on a QoS feature extractor.As illustrated in Figure 1，an autoencoder is deployed as the extractor to compress data in high dimensions into low-dimensional ones for dimension reduction，where feature extraction is performed.It consists of an encoder and a decoder，respectively，a pair of neural networks for compression and reconstruction.Besides，we also combine LSTM with the autoencoder.LSTM is a variant of Recurrent Neural Network(RNN)[25]，which is commonly used nowadays in sequential data related tasks，such as natural language processing problems.It demonstrates the promising capability of feature extraction for time series with additional memory cells that do not exist in RNNs.For better illustration，the notations used in this work are listed in Table 1.

Figure 1. Overview of the proposed LSTM-AE based feature extractor for QoS-aware Traffic Classification.

Table 1. List of notations used in this work.

Specifically，an LSTM-AE is implemented for extracting the feature from the series of sampled QoS KPIs.The overall structure includes a benchmarking LSTM encoder-decoder pair which maps the input traffic KPI sequences in the form of time series and the corresponding reconstructed KPI sequences.The encoder part in the structure can understand the time-dependent relationship and be capable of temporal feature extraction.Letfandgbe the encoder and the decoder，respectively.The objective of the LSTMAutoencoder is given as follows，

where P is a set of extracted featurePithat contains the temporal representation of the corresponding original time seriesQibelongs to the traffic set Q.

3.2 QoS-aware Feature Extraction

Network traffic originated from network applications describes the data movement in the communication networks，where QoS represents the overall performance of the corresponding network service.It also describes the property of the corresponding network traffic and affects the user QoE.To find the traffic representation and quantify the QoS，we define a set of network KPIs，such as throughput，packet loss rate，etc.，as the representation of the QoS characteristics.To perform continuous classification and provide timely classification results，an observation window is defined to divide the KPI sequences into time series with equal lengthT0.Given a fixed sample periodτ，sampled values of the KPIs forms the time sequenceQi，t，i.e.，

which represents the KPI set associated with the traffic originated from any network behaviors of thei-th application that is captured at timet.For simplicity，we useQito denote any KPI set of thei-th application that is collected from attribute time.vmtis them-th QoS KPI sampled att-th sampling period，Mis the number of KPIs in scope，and the selection of KPIs can be modified upon user requests.Direct traffic classification by using sets ofQiis inefficient as the computational complexity will be raised due to the increasing size caused by more considered network KPIs or a longer sampling duration.Instead，we propose to using a feature extractor to capture the features in lower dimensions，e.g.，to extract QoS representationsPifromQithrough functionf(·)，such that

As shown in Figure 1，the encoder first computes the QoS representation，and then the decoder reconstructs the representation to the original input KPI series.In order to learn the associations of the corresponding QoS classes and the individual QoS characteristics，we propose a function as follows to represent the QoS-awareness.

Figure 2. The illustration of the graph G=(V，A).

whereC={C1，C2，··· ，Ck}is a set of QoS class centers，which need to be generated first by using historical traffic data.The QoS-awareness is made up of two components，i.e.，J1is the intra-APP diversity term that is assessed by measuring the reconstruction performance of the individual traffic samples.J2is the inter-APP term that measures the relationship among the QoS classes.λin Eq.(6) is a factor that adjusts the impact of the second term in the determination of the QoS-awareness.Both terms are computed by using the parameter setθin the model that optimized through training by using the samples in training setQ={Q1，Q2，··· ，Qj}.Although the traffic clustering can then be performed with the consideration of the QoS-awareness，QoS classes used to compute such awareness for dynamic network traffic have yet been generated.

3.3 QoS Class Generation

In this section，we introduce the process of QoS class generation.To be specific，we break it down into three tasks，i.e.，clustering QoS classes，avoiding empty QoS classes，and determining the number of QoS classes.

3.3.1 Constrained QoS Clustering

Let C be a set of QoS classes，i.e.，C ={O1，O2，··· ，Ok}，wherekis the number of QoS classes，andCiis the centroid(class center)of thei-th class that is calculated as follows:

wherePjis thej-th QoS representation in classOk，and|Ok|denotes the total number of QoS representations in thek-th QoS class.

Assume that the similarity between a traffic and a QoS class is measured by a distance functiond(·，·)，the objective function is defined below:

Without loss of generality，we use Euclidean distance computed by?2-norm function，i.e.，

where a smallerdErepresents a higher similarity between a network flow and the QoS class.In contrast，a largerdvalue means a lower similarity between them.The minimization in the summation of Eq.(8)can be removed according to Lemma 2.1 in[39]by adding a binary flagαi，j.Therefore，the optimization problem defined in Eq.(8)is equivalent to

where the constraint in Eq.(10b) requires each network flow to be clustered by one and only one QoS class; the constraint in Eq.(10c) requires all the QoS classes contain at least one network flow to avoid null QoS classes.αi，jis a binary indicator that shows the class membership where a network flow belongs to itsnearestQoS class，i.e.，

3.3.2 Avoiding Empty QoS Class

The optimization problem can be equivalent to a linear network optimization problem for solving a Minimum Cost Flow.We model a network as directed acyclic graphG= (V，A) as illustrated in Figure 2，whereVis a set of nodes，and each nodei ∈Vhas a demand valuebi.It can be either a demand node(bi ＜0)，a supply node (bi ＞0)，or a transshipment node (bi= 0).We assume the summation of all the demands equals the sum of the supplies，i.e.，to ensure the problem is solvable.Ais a set of directed arcs，letyi，jandci，jdenote the flow amount and the cost on the arc(i，j)，respectively.We have a Minimum Cost Flow problem，i.e.，

Figure 3. Initialized features.

Figure 4. QoS-aware features extracted by the proposed LSTM-AE.

Figure 5. QoS-aware features visualized by applying T-SNE.

LetPibe a supply node withbPi= 1，Cjbe a demand node withbCj=-1，there are arcs(Pi，Cj)∈Awith the corresponding costc(Pi，Cj)=‖Pi-Cj ‖22.An artificial demand nodeαwithbα=k-Nis added to satisfy the constraint，and the costcCj，α=0.

In particular，we have a graph withV={Pi，i=1，...，N} ∪{Cj，j= 1，...，k} ∪αandA={(Pi，Cj)，Pi，Cj ∈V}∪{(Cj，α)，Cj ∈V}，which has an equivalent formulation of Minimum Cost Flow and can be solved by network optimization in[40].

3.3.3 Finding the Number of QoS Classes

Without loss of generality，Bayesian Information Criteria(BIC)is applied to determine the number of QoS classes from the extracted features.BIC is commonly used to balance the model complexity and the model performance [41].By treating the number of QoS classeskas the model complexity in a clustering process，Bkis defined as the BIC value calculated as follows:

whereNis the number of flows to be clustered，andRkis the sum of root of squared error，i.e.，

LetKmaxbe the maximum targeting number of QoS classes，such thatk ≤ Kmax.Note thatKmaxis capped at the total number of network flowsN.The proposed clustering algorithm is performed withk ∈{1，2，...Kmax}，whereBkis calculated with varyingk.After all enumeration ofkfrom 1 toKmax，thek*that provides the lowest BIC will be considered as the optimal number of QoS classes.The overall algorithm is summarized in Algorithm 1，where P is the set of temporal QoS representations.

3.4 Intra-APP Diversity

Suppose the encoder network provides the feature extraction functionfθ(·)，andgθ(·) is a reconstruction function provided by the decoder network that works inversely，whereθis the parameter in the LSTM-AE.The extracted featurePi=fθ(Qi) can be reconstructed back to the original input，i.e.，Q′i=gθ(Pi)=gθ(fθ(Qi))，whereQ′idenotes the reconstructed KPI set.Essentially，if the feature extractor is capable of extract distinct QoS features from the correspondingQi，the difference between them should be minimized，i.e.，

Algorithm 1. QoS class generation with constrained clustering.Input: P，Kmax Output: Cj 1: initialization;2: for k =1 to Kmax do 3: Choose k initial centers Pi ∈P of QoS classes;4: repeat 5:1)Assign Pi ∈P to Cj，where Cj is the closest QoS class of Pi;6:2)Update the QoS class centroids by Eq.(8);7: until Cluster centroids convergence，or reaching the assigned maximum iteration time;8: Save the current model Ck;9: Compute Bk based on Eqs.(13) and (14) for Ck;10: end for

The objective of the extractor and the reconstructor is to minimize the difference between the original KPI set and the recovered KPI set that is reconstructed by using the extracted features.The diversity of the extracted QoS features from all traffic，including the traffic originated from the same application，can thus be ensured.To be specific，J1is to maintain the diversity and is computed as follows:

J1aims to reconstruct the input samples and allow the encoder in the RNN Autoencoder to extract their individual features，which ensures the intra-APP diversity of the extracted QoS features，andNis the number of training samples.

3.5 Inter-APP Similarity

Although the feature extractor can directly obtain the QoS features regarding the traffic diversity，the quantification of inter-APP similarity needs the initialization of QoS classes.To be specific，QoS classes are clusters of network traffic，and each QoS class contains traffic that has similar network behaviors and QoS demands.The distances between the samples and the QoS classes are measured to indicate the similarity.Specifically，Euclidean distancedEis computed，i.e.，

Algorithm 2. QoS class generation with constrained clustering.Input: Q，Kmax Output: fθ，gθ 1: initialization;2: Set E as the number of epochs of iteration;3: Set A as the number of batches;4: Set γ as the learning rate;5: Generate QoS classes:6: for k =1 to Kmax do 7: θ ={W，b，bh};8: for e=1 to E do 9:for a=1 to A do 10:Compute reconstruction error in Eq.(16);11:Update θ though the gradient descent with learning rate γ;12:end for 13: end for 14: end for 15: Obtain QoS classes along with the corresponding centroids by Algorithm 1;16: Train the QoS-aware feature extractor:17: for e=1 to E do 18: for a=1 to A do 19:Compute loss function in Eq.(20);20:Update θ though the gradient descent with learning rate γ;21: end for 22: end for 23: Obtain fθ as the parameters in encoder;24: Obtain gθ as the parameters in decoder;

In order to learn QoS feature extraction with the consideration of QoS similarity among traffic，including the similarity of the traffic yields from different applications，the objective can be defined as

whereQ(k)idenotes theQithat belongs to thek-th QoS class;Ckis the centroid of thek-th QoS cluster;d(·，·)can be any distance function that describes the similarity between two features.With the aforementioned generated QoS classes，the functionJ2is to perform as a regularization term in Eq.(6)to ensure the inter-APP similarity，and it is computed as follows:

whereCj(i)denotes the centroid of thej-th QoS class that sampleibelongs to.J2regularizes the objective function to focus on setting up direct connections between the network traffic and the QoS classes to ensure the inter-APP similarity.The overall objective function to minimizeJ(Q，C，θ)as defined below:

Without loss of generality，gradient descent is used in the training the feature extractor，and the entire process is summarized in Algorithm 2.Note that the QoS classes need to be initialized so that the QoS classes can be used to train the QoS-aware feature extractor through Eq.(20)with the consideration of the similarity.

IV.EVALUATION

4.1 Dataset

Traffic from several popular Internet applications listed in Table 2 is used in the evaluation.Their downlink traffic statistics are captured through Wireshark with a sampling period ofτ= 100 ms.For concept proof，two statistical features are mainly considered here，i.e.，packet arrival rate and throughput.The packet arrival rate measures the count of the packets being received in a certain period，and the throughput is calculated by summing the sizes of all received packets in the period.Without loss of generality，these two statistical features are chosen as KPIs to represent network QoS.Table 2 summarizes our dataset，which includes the application name and the length of the captured traffic.

The Internet applications listed in Table 2 can be mainly classified into three service classes，i.e.，online video streaming，music streaming，and live streaming.Based on the service providers，these applications require to be supported by varying network qualities.For example，the audio traffic usually has a smaller throughput compared with traffic originated from video streaming applications since video streaming applications generate more data than music streaming.

Table 2. Summary of traffic used for evaluation.

4.2 Data Visualization with T-SNE

The application of T-SNE helps to demonstrate the results better，which is a visualization technique that allows the features to be presented at another feature space with a more intuitive output.It uses Gaussianand t-student distribution to model the similarity between the original data space and the new data space(whose dimension is usually lower than the original data space).Kullback-Leibler divergence is used to measure the distance distribution in these two data spaces，which defines the objective function，i.e.，

wherepijandqijare the joint probability of the sample distribution in the original data space and the new data space，i.e.，

wherexiandyiare the data points in different data spaces，σis the variance of the Gaussian distribution.Gradient descent is adopted to optimize the solution with iterations，and the gradient of the objective function in Eq.(21)is calculated as follow.

4.3 Evaluation Results

To evaluate the proposed QoS-aware classification approach，we first build the feature extractors.As a concept proof，we choose two KPIs，i.e.，packet arrival rate and the network throughput，to build a pair of LSTM-AE as feature extractors，which have identical network architectures with the size of (256，1，256)，where 256 denotes the number of hidden neurons in the LSTM layers.ReLU is applied as the activation function for non-linearity at the end of the layers.The training parameters are set as: the number of training epochs in each process is 100; the learning rate is 5×10-3; Adam is used as the optimizer for the model parameters;Pytorch is used as the implementation platform.Each constructed LSTM-AE is used to learn the feature from one of the selected QoS KPIs，i.e.，packet arrival rate and the network throughput.It is worth mentioning that the packet arrival rate and the throughput are independent of network condition in our analysis owing to the abundant network resources in the testing environment.They are known as the upper bound requirement of the service requirement，e.g.，the bandwidth required or suggested by YouTube，etc.we are measuring the QoS requirement for the network application without service interruption instead of the network capability that may bottleneck the network application.For example，we would like to measure the actual network QoS features that are needed to provide smooth video streaming from Amazon video.Currently，only the bandwidth recommendation is listed by the network application provider.With more QoS features determined and classified for smooth service delivery，the network resources can be managed more efficiently，while resource management is beyond the scope of this work.

A set of evaluation results is illustrated in Figure 3 to Figure 5，where Figure 3 illustrates the directly extracted features from KPI series with different length，i.e.，T= 600，800，1200.Figure 4 shows the QoSaware features，where the factor is set asλ=0.6，and the KPI series length are set toT= 600，800，1200.The value on the x-axis represents the extracted feature of the network throughput，and the y-axis value stands for the extracted feature of the packet arrival rate.For better illustration，the T-SNE is applied to the scatters in Figure 4，and the new scatters are illustrated in Figure 5.

Figure 6.QoS-aware feature scatters.(λ=0.4，T =1200)

Figure 3a，F(xiàn)igure 3b，and Figure 3c present the initial features extracted from the original KPI time series.We can find that the scatters are widely spread since diversity was the only term considered at that time.A direct implementation of the K-Means clustering algorithm here cannot show a clear view of QoSawareness，which is useless in supporting future network resource management.

By considering the similarity，new extracted features are illustrated in Figure 4a，F(xiàn)igure 4b，and Figure 4c，where the extracted features by our proposed LSTMAE feature extractor with QoS awareness are more close among the others in the same QoS class.From the results demonstrated in Figure 3a to Figure 5c，we can observe that a sufficient length of time series is required to ensure the QoS diversity among the Internet applications.QoS features extracted from the traffic statistics sampled in a shorter length lose the information of the diversity.For example，most traffic from the same application is separated from the traffic of other applications in Figure 5c since their QoS features contain the difference.But the Figure 5a，where shorter time series are used，does not separate them clearly.

Figure 7. QoS-aware feature scatters.(with T-SNE，λ =0.4，T =1200)

We further evaluate the proposed encoder with a new regularization factor，i.e.，λ= 0.4.Figure 6 and Figure 7 illustrated the extracted QoS-aware features and the features embedded by the T-SNE technique，correspondingly.Compared with the extracted QoSaware feature scatters in Figure 4c，the feature scatters in Figure 6 are more sparse.It also appears in the comparison between the feature scatters in Figure 5c and Figure 7，which are embedded through T-SNE.In particular，the extractor learned fewer features from QoS groups due to the smaller regularization factor，and they tend to keep more features regarding traffic diversity.

As an extended serial input provides a better feature extraction，we use a larger observation window，i.e.，T= 2000，to conduct the simulation again andstudy the clustering details regarding the traffic QoS.The number of packets series of the YouTube Music traffic and Pandora traffic have been illustrated in Figure 8 and Figure 9，corresponding.Although the traffic was captured from the same originated application，the traffic in different observation windows is clustered into different classes.The high volume traffic has been classified into Class 1.In contrast，the others have been classified into Class 0.

Figure 8. Traffic QoS diversity in YouTube Music traffic.

Figure 9. Traffic QoS diversity in Pandora traffic.

V.CONCLUSION

In this paper，we presented a novel NTC scheme with QoS-awareness by treating network traffic as time series with multi-variants.The key of the proposed scheme is a feature extractor that extracts traffic features from network QoS KPIs while considering intra-APP diversity and inter-APP similarity to ensure QoS awareness.A constrained K-means based clustering scheme was applied in this work to generate QoS classes.Real-life data was collected for evaluating the proposed approach，and the simulation results demonstrated the effectiveness of the proposed approaches.In the future，we will further analyze and improve the computational efficiency of the proposed scheme to provide real-time QoS-aware network traffic clustering.Extensive evaluations will also be conducted to test the generality of the proposed approach by using newly collected datasets or public datasets.