Network traffic classification method and system based on two-phase sequence feature learning

Abstract

The invention relates to a network traffic classification method based on two-phase sequence feature learning. The method is characterized by using a long short-term memory neural network to learn sequence features of network flow through two phases in data packet and network flow two aspects, wherein in the first phase, generating a data packet vector sequence on the basis of a traffic byte sequence; in the second phase, further generating a network flow vector on the basis of the data packet vector sequence; and finally, carrying out traffic classification on the network flow vector througha classifier. The method fully considers internal structure and organization relation of network traffic, effectively utilizes sequence feature learning capability of the long short-term memory neuralnetwork and carries out classification after obtaining comprehensive and complete traffic characteristics, so that a more accurate network traffic classification effect can be realized.

Description

technical field [0001] The invention relates to the field of computer network traffic analysis, in particular to a network traffic classification method and system based on two-stage sequence feature learning. Background technique [0002] Network traffic classification refers to the classification of network traffic into a certain target category according to specific business needs, which is a basic task in the field of network management and network security. For example, in the field of network management, traffic can be classified into different priorities to achieve better quality of service control; in the field of network security, traffic can be divided into normal traffic and malicious traffic to achieve network anomaly detection and protection measure. [0003] Currently, mainstream traffic classification methods include: port-based methods, deep packet inspection-based methods, statistics-based methods, and behavior-based methods. In the application of traditio...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to overcome the problem that the current network traffic classification method based on deep learning does not make full use of the structured information of network traffic, and provide a network traffic classification method that can learn network traffic at two levels of data packets and network flows in stages Sequence features, on this basis to achieve more accurate traffic classification effect

Images