A method for extracting common features of traffic data for network traffic identification

Abstract

The invention discloses a flow data public feature extraction method for network flow identification, and aims to solve the problem of rapid extraction of network flow data public features. Accordingto the technical scheme, a network traffic data public feature extraction system is constructed firstly; the system reads a network data message from a flow data file to generate a network flow linkedlist. Stream data sequences are constructed for elements in the network stream linked list. The stream data sequence is intercepted into feature sub-sequences with different lengths according to thefeature sub-sequence parameters. A stream feature tree is generated according to the feature sub-sequences. The length of each feature sub-sequence and the occurrence probability of each feature sub-sequence are calculated in the stream data sequence for each node. A common feature sequence meeting a feature sequence limiting parameter condition is limited from the stream feature tree after the node probability is calculated. The requirements of current network traffic identification on speed and accuracy of public feature extraction can be met.

Description

technical field [0001] The invention belongs to the technical field of network application traffic identification, and in particular relates to a method for extracting public features of traffic data used for network traffic identification. Background technique [0002] With the development of computer network technology, public characteristics of network traffic data have become an effective technical means for network traffic analysis and classification. Common features of network traffic data refer to byte sequences commonly contained in the same type of network traffic. figure 1 It is a schematic diagram of the relationship between existing network traffic identification methods and feature extraction of network traffic data. Such as figure 1 As shown, the existing network traffic identification method includes the following steps: [0003] The first step is to obtain the identified message data from the identified network traffic data; [0004] The second step is to...

AI Technical Summary

Problems solved by technology

[0008] 1) The traffic characteristics used for network traffic identification need to find out the common features with the highest probability of occurrence from a large number of identified traffic data sequences, and the longest common subsequence algorithm can only obtain the common subsequences of 2 data sequences for each calculation , resulting in finding the common feature with the highest probability of occurrence from a large number of identified traffic data sequences, it is necessary to go through multiple pairwise data sequence comparisons, the calculation amount increases exponentially, the calculation is complex, and the calculation speed is slow, so it cannot meet the needs of network traffic. The speed of recognition requires

[0009] 2) The longest common subsequence algorithm is mainly used to calculate the longest common subsequence of two data sequences. The probability of occurrence of different subsequences in traffic data cannot be counted, so it is impossible to determine whether the extracted common subsequence is a network flow feature

Images