Network flow classifying system and network flow classifying method combining DPI and DFI

Abstract

The invention discloses a network flow classifying system and a network flow classifying method combining a DPI and a DFI. The network flow classifying system is formed by combining a DPI service recognizing system module and a DFI flow recognizing system module, wherein the DPI module comprises a flow meter detecting module and a flow recognizing module; and the DFI module comprises a sample acquiring module, a classifier training module and a classifier classifying and predicting module. The sample acquiring module divides data stream capable of being accurately recognized by the flow recognizing module in the DPI into several classes and adopts the data stream as a sample to train the classifier training module so as to acquire a classifying model which can distinguish the class of thenetwork flow; then the flow which can not be recognized by the flow recognizing module of the DPI passes through the classifier classifying and predicting module of the DFI so as to achieve the aim for distinguishing the class of the flow which can not be recognized by the DPI. The invention is more comprehensive than a method for singly using the DPI or the DFI and can accurately recognize a service which is not encrypted in an application layer and distinguish the class of the service which is encrypted in the application layer.

Description

technical field [0001] The invention relates to a network flow classification system and a classification method combining DPI and DFI, belonging to the field of network data transmission. Background technique [0002] With the continuous emergence of network applications, emerging services such as P2P, online games, IPTV, and WEBTV occupy most of the bandwidth of the Internet. P2P applications represented by BT and Edonkey have already occupied more than 2 / 3 of the entire Internet traffic. Network construction has fallen into an abnormal situation of "congestion-expansion-re-congestion", and the profitability is correspondingly reduced. Failure to realize service identification increases the operator's operating costs and reduces customer satisfaction. Therefore, how to deeply perceive network applications, provide network service control and management methods, build a harmonious network that can be operated and managed, effectively restrict P2P, guide it reasonably, and ...

AI Technical Summary

Problems solved by technology

[0009] The technical problem to be solved by the present invention is that, for the low accuracy rate of the port identification technology, the DPI and DFI technologies respectively have the defects that it is very difficult to identify the business of application layer data encryption, and they can only distinguish between large categories of network traffic. Proposed a network traffic classification system and classification method combining DPI and DFI

Images