Internet flow distinguishing method

Abstract

The invention discloses an internet flow distinguishing method. According to a small quantity of marked flow samples and by virtue of offline supervised learning classification, unmarked flows are identified according to the characteristics of classified flows, and application classes of generated flows can be predicted in the early stage of network flow generation, thereby ensuring the promptness of network supervision and classifying the network flows in an actual network environment further. Through further adding new application types in semi-supervised clustering, a correlation chart of application type marks and application types is perfected, and alleged flows in the network are effectively marked, therefore, flow data with accurate application type labels can be obtained in real time. Meanwhile, when the network environment changes, the change of the network environment is reflected in the semi-supervised clustering, and the requirement on the distinguishment of flows in a new network environment is further met.

Description

Technical field [0001] The invention relates to a method for obtaining network traffic classification, in particular to a method for distinguishing Internet traffic. Background technique [0002] Internet traffic classification is mainly based on the characteristics of network traffic, such as data packet size, packet interval time, etc., to predict the type of network application that generates the traffic. Therefore, the network administrator can monitor and control the usage of network resources according to the classification results, and ensure the quality of the services provided. [0003] The existing realization of network traffic differentiation is mainly based on intelligent methods based on supervised learning (corresponding to supervised classification) and intelligent methods based on semi-supervised learning (corresponding to semi-supervised classification). [0004] Among them, the network traffic distinction method based on supervised learning can be divided into two...

AI Technical Summary

Problems solved by technology

Its disadvantages: in the real network environment, it is very difficult to obtain traffic samples with accurate application type labels due to the limited frequency of application types; the applicability of this method is limited by its training samples, that is, the network traffic that needs to be distinguished from the training There is similarity between the traffic samples of the classification model; new application types cannot be discovered, only trained application types can be identified

Disadvantages of this method: its computational complexity brings high delay and computational overhead

[0008] Disadvantages of this method: the classification task is not completed in real time in the real network environment, the impact of network status changes on the classification system has not been taken into account, and there is a gap between the deployment of the actual online traffic classification system in the real network environment; due to the lack of application The traffic data of the type label does not know which type of application it is generated, so the authenticity of the classification results needs to be verified, but the existing online classification technology lacks the verification of the authenticity of the classification results

[0027] (2) High function density

Images