基于层次聚类的网络流识别算法研究

doi:10.3969/j.issn.1000-436x.2014.z1.009

摘要/Abstract

摘要：

摘要：利用核函数定理提出了一种改进的网络流识别算法。首先运用对称不确定性的概念选择出最相关的流测度，然后利用核函数定理对选择的网络流测度进行高维映射，以测度的高维空间距离作为度量各个类差别的标准，提高了聚类结果的准确性。采用光滑因子、轮廓系数和不确定熵来控制聚类过程。实验表明，该算法的聚类结果更均匀，没有出现某个类占过大比重的情况且根据高维空间的类距离能够检测出网络流里的大部分流量。

关键词: 流量识别, 聚类分析, 核函数映射, 对称不确定分析

Abstract:

An improved net traffic identifier algorithm was proposed based on semi-supervised clustering.Symmetrical uncertainty was used to reduce the net flow attributes,and then kernel function was used to project the rest attributes to higher dimentional space.The train net flow was clustered in high dimentional space hierarchically.Smooth factor,sihouette coefficient and entropy controlled the cluster process to get a well result.Experiments show that the algorithm got flat clusters without any huge cluster and could identify most net flow even encrypted ones.

Key words: traffic identify, hierarchical cluster, kernel function, sihouette coefficient

丁伟,徐杰,卓文辉. 基于层次聚类的网络流识别算法研究[J]. 通信学报, 2014, 35(Z1): 41-45.

Wei DING,Jie XU,Weng-hui ZHUO. Net traffic identifier based on hierarchical clustering[J]. Journal on Communications, 2014, 35(Z1): 41-45.

图/表 2

参考文献 13

[1]	TRUONG P , GUILLEMIN F . Dynamic binary tree for hierarchical clustering of IP traffic[A]. IEEE Global Telecommunications Conference[C]. Washington,DC, 2007. 6-10.
[2]	DU X , ZHOU Z , YANG Y J . Research of applying information entropy and clustering technique on network traffic analysis[A]. Computational Intelligence and Security[C]. Suzhou,China, 2008. 472-476.
[3]	SON C , CHO S H , YOO J H . Volume traffic anomaly detection using hierarchical clustering[A]. Management Enabling the Future Internet for Changing Business and New Computing Services Lecture Notes in Computer Science[C]. 2009. 291-300.
[4]	SHUKLA D B , CHANDEL G S . An approach for classification of network traffic on semi-supervised data using clustering techniques[A]. Nirma University International Conference on Engineering (NUiCONE)[C]. Ahmedabad, 2013. 1-6.
[5]	WANG Y , XIANG Y , ZHANG J ,et al. Internet traffic classification using constrained clustering[A]. Parallel and Distributed Systems[C]. 2013. 1-4.
[6]	PALNATY R P , RAO A . JCADS:semi-supervised clustering algorithm for network anomaly intrusion detection systems[A]. Advanced Computing Technologies (ICACT15th)[C]. Rajampet, 2013. 1-5.
[7]	WANG Y , XIANG Y , ZHANG J . Network traffic clustering using Random Forest proximities[A]. IEEE International Conference on Communications (ICC)[C]. Budapest, 2013. 2058-2062.
[8]	LU W , XUE L . A heuristic-based co-clustering algorithm for the internet traffic classification[A]. The 28th International Conference on Advanced Information Networking and Applications Workshops (WAINA)[C]. Victoria,BC, 2014. 49-54.
[9]	CHIOU T W , TSAI S C , LIN Y B . Network security management with traffic pattern clustering[J]. Soft Computing, 2014,18: 1757-1770.
[10]	JUVONEN A , SIPOLA T . Adaptive framework for network traffic classification using dimensionality reduction and clustering[A]. The 4th International Congress on Ultra Modern Telecommunications and Control Systems and Workshops (ICUMT)[C]. Petersburg, 2012. 274-279.
[11]	ZHANG M , ZHANG H L , ZHANG B . Encrypted traffic classification based on an improved clustering algorithm[J]. Trustworthy Computing and Services Communications in Computer and Information Science, 2013,320: 124-131.
[12]	PRESS W H , TEUKOLSKY S A , VETTERLING W T ,et al. Numerical Recipes in C[M]. London: Cambridge University PressPress, 1988.
[13]	KARAGIANNIS T , PAPAGIANNAKI K , FALOUTSOS M . BLINC:multilevel traffic classification in the dark[J]. ACM SIGCOMM Computer Communication Review, 2005,35(4): 229-240.

应用类别	所含协议	字节比重
Mail	pop,smtp,imap,etc	0.196
域名解析	Dns,mdns,whois-das,etc	11.25
DataBase	Postgresql,mssql,mysql,etc	0.498
P2P	cDonkey,BT,pplive,etc	12.67
Interactive	telnet,rdp,ssh,vnc,smb,elc	0.46
VoIP	Skype,teamspcak,viber,etc	4.52
WWW	http,http_proxy,elc	63.41
BULK	ftp	0.054
Service	Ntp,netbios,nfs,upnp,etc	0.65
其他	Remotescan,games,vpn	6.286

测度	描述	重要度
低位端口	NetFlow字段	1
传输层协议	NetFlow字段	0.621
双向字节数	前/后向字节数之和	0.582
平均报文长度	双向字节数/双向报文数	0.563
BPS	字节数/持续时间	0.538
平均到达间隔	持续时间/报文数	0.538
双向报文数	前/后向报文数之和	0.521
双向报文数比	前/后向报文数之比	0.519

[1]	李骜, 冯聪, 牛宇童, 徐士彪, 张英涛, 孙广路. 面向视角非对齐数据的多视角聚类方法[J]. 通信学报, 2022, 43(7): 143-152.
[2]	言洪萍, 周强, 王世豪, 姚旺, 何刘坤, 王良民. 基于SDN的实际网络流中Tor网页复合特征提取方法[J]. 通信学报, 2022, 43(3): 76-87.
[3]	郭秉礼,赵宁,朱志文,宁帆,黄善国. 数据中心中面向光互联的流量识别与调度研究[J]. 通信学报, 2018, 39(9): 122-128.
[4]	迟荣华,程媛,朱素霞,黄少滨,陈德运. 基于快速高斯变换的不确定数据聚类算法[J]. 通信学报, 2017, 38(3): 101-111.
[5]	赵春晖,李雪源,崔颖. 混合编码方式的图像聚类算法[J]. 通信学报, 2017, 38(2): 1-9.
[6]	潘吴斌,程光,郭晓军,黄顺翔. 网络加密流量识别研究综述及展望[J]. 通信学报, 2016, 37(9): 154-167.
[7]	丁伟，徐杰，卓文辉. 基于层次聚类的网络流识别算法研究[J]. 通信学报, 2014, 35(Z1): 9-45.
[8]	董永苹1，余翔湛2，吴刚1. 基于决策树的P2P节点识别技术研究[J]. 通信学报, 2013, 34(Z2): 9-46.
[9]	董永苹,余翔湛,吴刚. 基于决策树的P2P节点识别技术研究[J]. 通信学报, 2013, 34(Z2): 40-46.
[10]	刘文杰,伍之昂,曹杰,潘金贵. 基于成对约束Info-Kmeans聚类的图像索引方法[J]. 通信学报, 2013, 34(7): 159-166.
[11]	刘文杰1，伍之昂2，曹杰2，潘金贵1. 基于成对约束Info-Kmeans聚类的图像索引方法[J]. 通信学报, 2013, 34(7): 18-166.
[12]	闫健恩1，袁春阳2，许海燕1，张兆心1. 基于多维流量特征的IRC僵尸网络频道检测[J]. 通信学报, 2013, 34(10): 6-55.
[13]	闫健恩,袁春阳,许海燕,张兆心. 基于多维流量特征的IRC僵尸网络频道检测[J]. 通信学报, 2013, 34(10): 49-55.
[14]	董仕,王岗. 基于UDP流量的P2P流媒体流量识别算法研究?[J]. 通信学报, 2012, 33(12): 25-34.
[15]	张众,杨建华,谢高岗. 高效可扩展的应用层流量识别架构[J]. 通信学报, 2008, 29(12): 22-31.