Network traffic classification method based on machine learning acceleration

Abstract

The invention belongs to the technical field of network security, and discloses a network flow classification method based on machine learning acceleration, which comprises the following steps: takingthe characteristics of network flow data to be identified as the input of a random forest model by utilizing the characteristic vectors of the network flow data, and carrying out supervised learningof network flow; then, extracting a protocol matching rule from the trained model, so that a rapid identification matching function of the network traffic protocol is realized; meanwhile, in combination with a deep packet detection method, the classification speed is greatly increased under the condition that the recognition accuracy of an existing scheme is ensured. By reducing multiple blind matching in a traditional deep packet detection scheme, the problem of performance loss caused by the multiple blind matching is solved, and the detection efficiency of the network traffic classificationsystem in actual use and the throughput of the system are improved. Meanwhile, the improved scheme provided by the invention has very high compatibility, supports all existing novel deep packet detection matching improved algorithms, hardware acceleration schemes and the like, and has very high practical value and significance.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a network traffic classification method based on machine learning acceleration. Background technique [0002] Currently, the closest existing technology: With the increase of network size and density, protocols become more diverse, and related traffic classification and analysis work becomes more and more important. Identifying traffic flows is a very important problem in the Internet. The mainstream methods are mainly based on port, host behavior connection, deep packet inspection and machine learning. But the first two methods cannot adapt to the current network environment, because many applications increasingly use unpredictable or random port numbers, and the network connection behavior between hosts is greatly affected by the complex network environment. Therefore, the commonly used traffic analysis and classification methods are deep packet inspectio...

AI Technical Summary

Problems solved by technology

[0006] To sum up, the problems existing in the existing technology are: the existing deep packet detection method is slow and the matching is cumbersome; the model of the machine learning method has high requirements and the accuracy is unstable; the method of machine learning and deep packet detection has The resulting performance overhead is large, and the usage scenarios are scarce

Deep packet inspection technology has strong identification accuracy and strong analytical power, but limited self-renewal and improvement capabilities; machine learning technology is fast in identifying network protocols, and can self-improvement to a certain extent, but the algorithm requirements are high and the accuracy cannot be guaranteed; the common identification method combining the two Considering both time and precision, it wastes a lot of computing resources and has limited effects and application scenarios

Images