A Content Aware Method Based on Network Stream Behavior

Abstract

The invention provides a content perception method based on network flow behavior, which includes the following steps: collecting network traffic in an external network environment and extracting observation features as training samples; using the training samples to train the model; inputting unknown types of network flow into the model Identify its content; use the identified network flow data and historical model parameters to perform incremental learning, update model parameters, and ensure the continuity of model classification. The present invention utilizes the dynamic modeling capability of the hidden Markov model and the powerful non-linear representation capability of the deep neural network, and the experimental results show the feasibility of the method and the performance advantage compared with the existing technical solutions.

Description

technical field [0001] The invention belongs to the field of network technology, and more specifically relates to a content perception method based on network flow behavior. Background technique [0002] Classification and identification of network traffic is fundamental to many network management problems. By accurately identifying the type of network traffic, network administrators can provide different types of network applications / services with different quality of service according to a given strategy; Infrastructure planning provides a basis; in addition, traffic classification is also a key part of the intrusion detection system, which prevents attacks by identifying abnormal network traffic, and is an important detection method in the field of network security. [0003] There are four commonly used traffic classification methods: 1) method based on port, 2) method based on packet load characteristics, 3) method based on flow, and 4) method based on mixed characteris...

AI Technical Summary

Problems solved by technology

The DPI method also has its defects and deficiencies: First, as people's awareness of network security increases, more and more applications use encrypted protocols to transmit data (see the paper "Velan P, M, P, et al.A survey of methods for encrypted traffic classification and analysis[J].International Journal of Network Management,2015,25(5):355-374."), DPI is difficult to handle encrypted traffic; secondly, user data Packet analysis involves privacy protection issues; third, it is impossible to obtain the characteristic structure description of private protocols

Just identifying the protocol or application corresponding to the traffic is not enough to implement effective supervision on the network flow

Images