the Naive Bayes classifier technique. The basis of categorizing work is to classify the type of Internet traffic; this is done by putting common groups of applications into different categories, e.g., "normal" versus "malicious", or more complex definitions, e.g., the identification of specific applications or specific Transmission Control Protocol (TCP) implementations. Adapted from Logg et al. Survey Traffic classification is a major component of automated intrusion detection systems. They are used to identify patterns as well as an indication of network resources for priority customers, or to identify customer use of network resources that in some way contravenes the operator’s terms of service. Generally deployed Internet Protocol (IP) traffic classification techniques are based approximately on a direct inspection of each packet’s contents at some point on the network. Source address, port and destination address are included in successive IP packets with similar if not the same 5-tuple of protocol type. ort are considered to belong to a flow whose controlling application we wish to determine. Simple classification infers the controlling application’s identity by assuming that most applications consistently use well-known TCP or UDP port numbers. Even though, many candidates are increasingly using unpredictable port numbers. As a result, more sophisticated classification techniques infer application types by looking for application-specific data within the TCP or User Datagram Protocol (UDP) payloads. Global Internet traffic Aggregating from multiple sources and applying usage and bitrate assumptions, Cisco Systems, a major network systems company, has published the following historical Internet Protocol (IP) and Internet traffic figures: "Fixed Internet traffic" refers perhaps to traffic from residential and commercial subscribers to ISPs, cable companies, and other service providers. "Mobile Internet traffic" refers perhaps to backhaul traffic from cellphone towers and providers. The overall "Internet traffic" figures, which can be 30% higher than the sum of the other two, perhaps factors in traffic in the core of the national backbone, whereas the other figures seem to be derived principally from the network periphery. Cisco also publishes 5-year projections. Internet backbone traffic in the United States The following data for the Internet backbone in the US comes from the Minnesota Internet Traffic Studies (MINTS): The Cisco data can be seven times higher than the Minnesota Internet Traffic Studies (MINTS) data not only because the Cisco figures are estimates for the global—not just the domestic US—Internet, but also because Cisco counts "general IP traffic (thus including closed networks that are