Network traffic classification method and device

Abstract

The invention provides a network flow classification method and device, which relate to the field of computer network security. The method includes an offline training stage and an online identification stage: the offline training stage includes: S1, constructing the application type distribution map of the training data set, obtaining the corresponding relationship, and calculating the probability; S2, constructing the corresponding relationship table between ports and applications; S3, establishing Decision factor; the online identification stage includes: S4, obtain the port pair, select one of the ports as the decision port; S5, select the classifier; S6, select the load-based classification module as the classifier, and when the classification result is not empty, the One-way supervision is performed on the corresponding relationship and its probability value, and the corresponding relationship is evaluated and the probability is updated. The invention reduces the detection of data packet content in the network traffic classification process, reduces the demand for memory and bandwidth, and infringes on user privacy, and realizes high-speed and high-precision traffic classification under high-speed network links.

Description

Technical field [0001] The invention relates to the field of computer network security, in particular to a network traffic classification method and device. Background technique [0002] Network traffic classification technology plays a very important role in network management. Network managers or network service providers (ISPs) can formulate traffic control strategies or provide support for current or next-generation services based on the classification results. Therefore, quickly and accurately classifying network traffic is the key to network management and monitoring. The current network traffic classification mainly faces two problems: 1) How to achieve high-precision recognition in the face of complex traffic generated by more and more new applications (such as P2P, games, and streaming media); 2) How to process dramas at a high speed Increased network data volume. [0003] Traditional methods to solve the above problems mainly use port-based classification methods and lo...

AI Technical Summary

Problems solved by technology

The current network traffic classification mainly faces two problems: 1) How to achieve high-precision identification in the face of complex traffic generated by more and more new applications (such as P2P, games, and streaming media); 2) How to process drama at high speed Increased amount of network data

[0004] Above, the port-based classification method has high recognition accuracy for identifying most traditional applications, and is the fastest and simplest method among existing methods, but more and more new applications use dynamic ports or use other protocols As a hidden application, it leads to the failure of port-based classification methods

Load-based classification methods, due to their high computational complexity, lead to increasingly poor performance in high-speed networks, and the identification process may violate user privacy

Although there are many optimization methods to improve the shortcomings of load-based classification methods, they require special hardware or high-performance processors and a large number of storage units, or need to process a large amount of packet content

In other words, traditional classification methods cannot effectively solve the above problems

Images