A Preliminary Performance Evaluation of K-means, KNN and EM Unsupervised Machine Learning Methods for Network Flow Classification

Alhamza Alalousi (School of Computer and Communication Engineering, Universiti Malaysia Perlis.)
Rozmie Razif (School of Computer and Communication Engineering, Universiti Malaysia Perlis)
Mosleh AbuAlhaj (Dept. of Network and Information Security, Faculty of Information Technology, Al-Ahliyya Amman University)
Mohammed Anbar (National Advanced IPv6 Centre of Excellence, Universiti Sains Malaysia)
Shahrul Nizam (School of Computer and Communication Engineering, Universiti Malaysia Perlis)

International Journal of Electrical and Computer Engineering
Vol 6, No 2: April 2016

Unsupervised leaning is a popular method for classify unlabeled dataset i.e. without prior knowledge about data class. Many of unsupervised learning are used to inspect and classify network flow. This paper presents in-deep study for three unsupervised classifiers, namely: K-means, K-nearest neighbor and Expectation maximization. The methodologies and how it’s employed to classify network flow are elaborated in details. The three classifiers are evaluated using three significant metrics, which are classification accuracy, classification speed and memory consuming. The K-nearest neighbor introduce better results for accuracy and memory; while K-means announce lowest processing time.