As per the definition of Deep Packet Inspection (DPI), it uses signatures for packet filtering. Supervised Machine Learning can help put a label on a packet which does not get identified by Deep Packet Inspection if it does not have a signature that the DPI recognizes. However, apart from this advantage, is there any other advantage/functionality supervised ML has over Deep Packet Inspection?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer. – Ron Maupin Dec 16 '20 at 23:03

There is another variable to consider when you compare DPI with ML systems, that is the detection rates. On ML basically you are using metrics related to traffic (with no inspection on the payload) that potentially generate a lot of False positives in terms of detection, also another disadvantage is that you need to retrain your model more constantly. The DPI will generate, in general, less FP if you have a good database for verify how is the quality of the generated signatures.


Traditionally, signatures are defined by a human having analyzed the various data streams.

ML learns the patterns by inference, making it (potentially) cheaper to train. Also, ML can be used to keep learning while it's running. Generally, it's more flexible and likely quicker to adapt.

Both may obtain similar results. However, the human-created signature is a formulated, comprehensible rule while ML filters might produce results that are less understandable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.