基于行为特征学习的互联网流量分类方法

doi:10.11959/j.issn.1000-0801.2016152

Abstract

Abstract:

The connection graph based internet traffic classification method can reflect the connectivity behavior between hosts.Thus，it has high stability.But the heuristic rules summarized for traffic classification are generally incomplete，and they difficultly obtain high classification accuracy.Host communication behavior model and BOF method was researched，and a set of host connection related behavior features （HCBF）was extracted from the multiple flows with the same ｛destination IP，destination port and transport protocol｝.To evaluate the performance of HCBF，it was compared with the existing feature set on the respect of basic classification performance and classification stability.The experiments were carried out on the traffic collected in the traditional and mobile networks.Results show that HCBF out performs existing feature sets.

Key words: internet traffic classification, behavior feature, machine learning, communication behavior, network measurement

Zhen LIU,Ruoyu WANG. Internet traffic classification method based on behavior feature learning[J]. Telecommunications Science, 2016, 32(6): 143-152.

Figures/Tables 18

References 19

[1]	WANG Y ， XIANG Y ， ZHANG J ，et al. Internet traffic clustering with side information[J]. Journal of Computer and System Sciences， 2014，80（5）： 1021-1036.
[2]	ZHANG J ， CHEN X ， XIANG Y ，et al. Robust Network Traffic Classification[J]. IEEE/ACM Transactions on Networking， 2015，23（4）： 1257-1270.
[3]	DAINOTTI A ， PESCAP A . Issues and future directions in traffic classification[J]. IEEE Network， 2012，26（1）： 35-40.
[4]	CALLADO A ， KAMIENSKI C . A survey on Internet traffic identification[J]. IEEE Communications Surveys ＆ Tutorials， 2009，11（3）： 37-52.
[5]	KARAGIANNIS T ， PAPAGIANNAKI K ， FALOUTSOS M . BLINC：multilevel traffic classification in the dark[J]. ACM SIGCOMM， 2005，35（4）： 229-240.
[6]	ILIOFOTOU M ， KIM H ， FALOUTSOS M ，et al. Graption：a graph-based P2P traffic classification framework for the internet backbone[J]. Computer Networks， 2011，55（8）： 1909-1920.
[7]	BERMOLEN P ， MELLIA M ， MEOB M ，et al. Abacus：accurate behavioral classification of P2P-TV traffic[J]. Computer Networks， 2011（55）： 1394-1411.
[8]	ASAI H ， FUKUDA K ， ESAKI H . Traffic causality graphs：profiling network applications through temporal and spatial causality of flows[C]// The 23rd International Teletraffic Congress，Sept 6-9，2011，San Francisco，CA，USA. New Jersey： IEEE Press， 2011： 95-102.
[9]	MOORE A ， ZUEV D ， CROGAN M . Discriminators for use in flow-based classification[C]// In Passive ＆ Measurement Workshop 2003（PAM2005），August1，2005，London，England.[S.1.：s.n.]. 2005.
[10]	HAJJAR A ， KHALIFE J，DAZ-VERDEJO J . Network traffic application identification based on message size analysis[J]. Journal of Network and Computer Applications， 2015（58）： 130-143.
[11]	LIU Z ， WANG R Y ， TAO M ，et al. A class-oriented feature selection approach for multi-class imbalanced traffic datasets based on local and global metrics fusion[J]. Neurocomputing， 2015（168）： 365-381.
[12]	FAHAD A ， TARI Z ， KHALIL I ，et al. Toward an efficient and scalable feature selection approach for internet traffic classification[J]. Computer Networks， 2013，57（9）： 2040-2057.
[13]	HONG Y ， HUANG C C ， NANDY B ，et al. Iterative-tuning support vector machine for network traffic classification[C]// The 2015 IFIP/IEEE International Symposium on Integrated Network Management，May 11-15，2015，Ottawa，ON，Canada. New Jersey： IEEE Press， 2015： 458-466.
[14]	HJELMVIK E ， JOHN W . Breaking and improving protocol obfuscation：No.2010-05，ISSN 1652-926X[R].[S.1.：s.n.]， 2010： 1-34.
[15]	LEE S ， KIM H ， BARMAN D ，et al. NeTraMark：a network traffic classification benchmark[J]. ACM SIGCOMM Computer Communication Review， 2011，41（1）： 23-30.
[16]	GRINGOLI F ， SALGARELLI L ， DUSI M ，et al. GT：picking up the truth from the ground for internet traffic[J]. ACM SIGCOMM Computer Communication Review， 2009，39（5）： 13-18.
[17]	ZHANG J ， XIANG Y ， WANG Y ，et al. Network traffic classification using correlation information[J]. IEEE Transactions on Parallel ＆ Distributed Systems， 2013，24（1）： 104-117.
[18]	WILLIAMS N ， ZANDER S ， ARMITAGE G . A preliminary performance comparison of five machine learning algorithms for practical IP traffic flow classification[J]. SIGCOMM Computer Communication Review， 2006，30（5）： 5-16.
[19]	徐鹏，林森 . 基于C4.5决策树的流量分类方法[J]. 软件学报， 2009，20（10）： 2692-2704. XU P ， LIN S.Internet traffic classification using C4 . 5 decision tree[J]. Journal of Software， 2009，20（10）： 2692-2704.

Metrics

Recommended 0

No Suggested Reading articles found!

名称	含义
RaSrcIPPort	源端口数与源IP地址数的比值
destPort	目的端口号
AvgPkts	每流平均报文数
MinPkts	最小报文数
MaxPkts	最大报文数
StdPkts	报文数的均方差
AvgByts	每流平均字节数
MinByts	最小字节数
MaxByts	最大字节数
StdByts	字节数的均方差
Proto	传输层协议
AvgDuration	每流持续时间
FailFlowN	失败流数目

类别	Day917_1		Day917_2		Day917_3
类别	#流/条	#字节/MB	#流/条	#字节/MB	#流/条	#字节/MB
HTTP	6 421	64.080	9 072	199.051	8 678	133.504
DNS	6 714	1.253	11 722	2.070	9 912	1.779
eDonkey	14 474	31.439	12 945	83.960	18 064	43.705
SSL	130	2.026	88	0.943	140	1.604
BT	2 198	15.422	3 072	3.076	3 258	19.943
HTTPvideo	24	13.948	22	48.096	18	32.256
Xunlei	1 792	3.725	1 348	2.565	2 400	31.162
QQ	770	0.822	479	1.646	646	1.833
Kugou	220	58.150	400	2.437	247	4.894

类别	Day925_1		Day925_2		Day925_3
类别	#流/条	#字节/MB	#流/条	#字节/MB	#流/条	#字节/MB
HTTP	10 786	87.707	8 687	123.760	9 109	82.783
DNS	11 480	2.645	7 371	1.190	7 097	1.201
eDonkey	589	16.937	360	16.912	329	7.526
SSL	133	9.474	348	108.942	146	13.335
BT	4 239	62.195	3 778	43.271	2 692	68.687
HTTPvideo	654	77.414	332	76.714	280	60.574
Xunlei	703	3.560	463	2.025	406	12.012
QQ	966	1.061	540	1.124	527	0.811
Kugou	1 557	1.707	139	5.657	129	8.749

类别	#流/条	#字节/KB
social	230	261.877
Web	33	0.190
VoIP	25	0.037
mail	32	0.460
shop	204	1.094
video	31	91.036
navigation	1 112	3.442
service	321	1.037
others	272	3.838
unknown	676	6.325

数据集	特征集合	流 g-mean	字节 g-mean	总体流分类准确率	总体字节分类准确率
Day917_1对比Day917_2	Abacus	0	0	87.8%	21%
	HCBF	41.2%	31.8%	90.4%	87%
Day917_1对比Day917_3	Abacus	0	0	86.8%	48.7%
	HCBF	59.9%	34.7%	92%	70.5%
Day925_1对比Day925_2	Abacus	23.3%	4.3%	80.4%	32.4%
	HCBF	46.8%	20.2%	88.3%	49.2%
Day925_1对比Day925_3	Abacus	34.4%	16.9%	85%	57.8%
	HCBF	33.9%	26%	86.9%	52%

Internet traffic classification method based on behavior feature learning

RichHTML

PDF下载

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 18

References 19

Related Articles 15

Metrics

Recommended 0

类别	流分类准确率		字节分类准确率
类别	Abacus	HCBF	Abacus	HCBF
HTTP	86.6%	86.3%	33.2%	96.3%
DNS	97.5%	99.9%	96.3%	99.3%
eDonkey	95.3%	96.7%	3.3%	88.8%
SSL	4.5%	31.3%	1.3%	25.2%
BT	60.2%	76.4%	20.5%	83.3%
HTTPvideo	0	20.2%	0.0%	22.4%
Xunlei	44.5%	65.4%	15.4%	12.4%
QQ	58%	64.2%	18.0%	19.1%
Kugou	1.5%	18.5%	0.1%	38.6%

特征集流 g-mean	字节 g-mean	总体流分类准确率	总体字节分类准确率
Abacus 17.2%	13.0%	83.0%	42.2%
HCBF35.8%	13.2%	86.5%	52.5%

特征集	流 g-mean	字节g-mean	总体流分类准确率	总体字节分类准确率
Abacus	0	0	90.8%	71.1%
HCBF	46.2%	45.5%	92.9%	85.3%

算法	特征集	流 g-mean	字节 g-mean	总体流分类准确率	总体字节分类准确率
随机	Abacus	10.4%	13.5%	84.9%	56.5%
森林	HCBF	32.3%	19.2%	91.4%	59.2%
1NN	Abacus	17.1%	17.6%	84.2%	53.1%
	HCBF	24.1%	13.8%	80.4%	51.7%

特征集	流g-mean	字节g-mean	总体流分类准确率	总体字节分类准确率
Abacus	0	0	87.1%	78.9%
HCBF	51.7%	9.1%	89.5%	79.1%

[1]	Zehua GUO, Haowen ZHU, Tongwen XU. Network modal innovation for distributed machine learning [J]. Telecommunications Science, 2023, 39(6): 44-51.
[2]	Yaqiong LIU, Zhe LYU, Yafei ZHAO, Guochu SHOU. A survey on AI techniques applied in the satellite communication/satellite Internet field [J]. Telecommunications Science, 2023, 39(2): 10-24.
[3]	Jianwu ZHANG, Yanjun AN, Huangyan DENG. A survey on DNS attack detection and security protection [J]. Telecommunications Science, 2022, 38(9): 1-17.
[4]	Zhichao ZHOU, Yi FENG, Xiaohan XIA, Yuyao FENG, Chao CAI, Jiahui QIU, Lihui YANG, Yunxiao WU. Outdoor location scheme with fingerprinting based on machine learning of mobile cellular network [J]. Telecommunications Science, 2021, 37(8): 85-95.
[5]	Xiang LI,Yuan LI,Zifei ZHANG,Zhe YANG. A density clustering-based network performance failure big data analysis algorithm [J]. Telecommunications Science, 2020, 36(9): 51-58.
[6]	Ziyu XIAO. A review of key technologies for the future of the 2030 network——Beyond 5G [J]. Telecommunications Science, 2020, 36(9): 114-121.
[7]	Yaxing QIU,Xidong WANG,Sen BIAN,Lei YUE. Load balancing based on clustering analysis and deep learning for multi-frequency and multi-mode network [J]. Telecommunications Science, 2020, 36(7): 156-162.
[8]	Ye OUYANG,Aidong YANG,Fanyu MENG. A game theory-assisted machine learning methodology for subscriber churn behaviors detection [J]. Telecommunications Science, 2020, 36(6): 79-89.
[9]	Feng LIN,Liujing XU,Xiaohua CHEN,Weiqiang QI,Ke CHEN,Tiantian ZHU. Method of Webshell detection based on multi-view feature fusion [J]. Telecommunications Science, 2020, 36(6): 125-132.
[10]	Jiantao SHENG,Maofei CHEN,Dongxin LIU,Laifu WANG,Guoshui SHI,Huamin JIN. Detection of malicious domain name based on a classifier combination [J]. Telecommunications Science, 2020, 36(5): 47-55.
[11]	Tao PANG,Haihua QIU,Biying PAN. Research on artificial intelligence key technologies of mobile terminal [J]. Telecommunications Science, 2020, 36(5): 145-151.
[12]	Qizhu ZHONG. Research and application of VoLTE video call quality based on machine learning [J]. Telecommunications Science, 2020, 36(3): 156-165.
[13]	Zishan LIU,Qiang CHENG,Bo LV. A survey on key technologies of privacy protection for machine learning [J]. Telecommunications Science, 2020, 36(11): 18-27.
[14]	Xiaolian CHEN,Yi QIN,Jie ZHANG,Yajie LI,Haokun SONG,Huibin ZHANG. Optical fiber eavesdropping detection method based on machine learning [J]. Telecommunications Science, 2020, 36(11): 61-67.
[15]	Fei GUI,Yang CHENG,Dan LI,Sihong HONG. Internet intelligent routing architecture and algorithm [J]. Telecommunications Science, 2020, 36(10): 12-20.

类别	流分类准确率		字节分类准确率
类别	Abacus	HCBF	Abacus	HCBF
HTTP	87.1%	92.2%	74.6%	76.8%
DNS	99.7%	99.9%	98.5%	98.7%
eDonkey	6.4%	13.0%	0.1%	2.5%
SSL	12.1%	73.4%	4.7%	55.1%
BT	60.2%	74.8%	3.2%	3.6%
HTTPvideo	68.1%	37.3%	29.7%	88.4%
Xunlei	3.0%	11.4%	0.7%	4.0%
QQ	37.6%	79.6%	19.3%	71.1%
Kugou	6.5%	21.7%	0.2%	33.2%