Data stream classification method and system based on machine learning

Abstract

The invention discloses a data stream classification method based on machine learning, which comprises the following steps: 1) capturing and filtering data streams on a network according to an input rule to obtain data packets meeting conditions; 2) establishing a data stream according to the quintuple information of the data packet, establishing an application stream in combination with the reverse data stream, extracting specified application stream feature information, and recording the application stream feature information in an application stream table; step 3) detecting whether the application flow completes an interaction process or not; if the application flow feature information is completed, packaging the application flow feature information into feature vectors, calling a machine learning classifier for classification to obtain a label La, entering a step 4), and otherwise, identifying the classification result of the application flow as an unknown application; and 4) searching an association information table to which the current application flow belongs, and determining a final classification result of the current application flow by combining machine learning classification information of historical application flows in the table. The method provided by the invention can effectively improve the classification accuracy of the current data flow.

Description

technical field [0001] The invention relates to the technical field of computer networks, in particular to a data flow classification method and system based on machine learning. Background technique [0002] Network data flow classification is an important part of network management work such as network security and service quality control. All data interacted with applications on the Internet is finally transmitted on the network in the form of data byte streams. By mapping network data streams with high-level applications, fine-grained regulation and review of traffic can be achieved. Traditional data flow classification methods are based on well-known ports and in-depth analysis based on packet load. With the increasing complexity of application types, well-known ports are no longer "famous", resulting in a decline in the accuracy of port-based classification methods; on the other hand, although methods based on deep packet inspection are more accurate, they have proble...

AI Technical Summary

Problems solved by technology

However, from the perspective of improving the classification accuracy in the data, in order to further improve the classification accuracy, it is necessary to dig deep into the various information hidden in the data stream, and simply introducing new algorithm models is not enough

Images