Encrypted traffic classification method based on two-stage judgment

Abstract

The invention discloses an encrypted traffic classification method based on two-stage judgment, which comprises the following steps: taking the classification output of a random forest classifier as the input of a K-nearest neighbor classifier, and finally fusing and comparing the results of the two classifiers to finish the classification of traffic data. The output characteristics of the randomforest algorithm and the reliability guarantee of two-stage judgment are fully utilized, and the classification accuracy can be improved. Accoridng to an encrypted traffic classification algorithm based on two-stage judgment, the method comprises the following steps of 1, training a meta-feature sequence to obtain a first-stage classification model, that is, a random forest model containing k trees, then, taking a label output by each tree as a new composite feature vector and input into a K-nearest neighbor classifier to be classified in the second stage, comparing results obtained after twotimes of classification wherein classification succeeds only when the results obtained after two times of classification are the same. Such a two-stage judgment model enables the final classificationaccuracy to be significantly improved.

Description

technical field [0001] The invention belongs to the field of network security and user privacy, and in particular relates to an encrypted traffic classification method based on two-stage judgment. Background technique [0002] In recent years, with the rapid development of the Internet, the network has been closely integrated into our production and life, and network security has become an issue that cannot be ignored. In daily life, people's awareness of network security has gradually increased, and more and more users and enterprises have begun to pay attention to the protection and safe transmission of information. The network behavior recognition technology based on encrypted traffic can be used to realize the security supervision of the network, especially the supervision of illegal business and bad information. Encrypted traffic analysis is to analyze the current user's online behavior through some characteristics of the traffic itself, rather than through the content...

AI Technical Summary

Problems solved by technology

These machine learning algorithms are relatively simple to use, but the accuracy is limited and cannot reach a satisfactory level

In the k-fingerprinting paper published by USENIX in 2016, a method combining KNN classifier and random forest classifier was also proposed. Their distance calculation uses Hamming distance, so that it can be used when the noise flow is large. Maintain a stability, but the accuracy rate is greatly limited and cannot be effectively improved

[0005] It can be seen that, apart from simple machine learning classification models, the classification methods used in encrypted traffic analysis have not been studied in depth, and related technologies have not been widely used.

Images