Deep learning traffic classification method based on combination of time-space characteristics

Abstract

The invention discloses a deep learning traffic classification method based on combination of time-space characteristics, and mainly solves the problem of low detection accuracy in the prior art. According to the implementation scheme, the method comprises the following steps: 1) collecting and marking original flow load data; 2) generating a preprocessed flow graph set based on the original flowload data; 3) training a deep learning model based on space-time characteristic combination by using the flow graph set; 4) verifying the trained deep learning model by using newly acquired and generated flow data, and deploying the model as a flow classifier at a real network node after the model is qualified; and 5) analyzing, classifying and labeling the traffic in the real network environment.According to the model constructed by the invention, the space-time characteristics of the traffic data are utilized, the traffic classification accuracy is improved, resources occupied by the classifier are reduced, the traffic classification requirement in the current network environment can be met, and the method can be applied to network edge nodes to realize encrypted traffic identificationand malicious traffic detection.

Description

technical field [0001] The invention belongs to the technical field of computer networks, and in particular relates to a traffic classification method, which can be applied to network edge nodes to realize encrypted traffic identification and malicious traffic detection. Background technique [0002] Today's network traffic environment is becoming more and more complex, how to continue to maintain efficient and fast malicious traffic detection has become a major challenge in today's network environment. The essence of traffic identification or malicious traffic detection is a classification problem, and traditional traffic classification methods, such as based on port numbers or deep packet inspection technology, cannot meet the task requirements well in today's network environment; methods based on traditional machine learning It is also used to deal with encrypted traffic identification and malicious traffic monitoring, but the complicated steps of artificially selecting f...

AI Technical Summary

Problems solved by technology

The disadvantage of this method is that the three models need to be weighted in different proportions when obtaining the final malicious traffic probability in the seventh step, but this method does not clearly indicate how to allocate the weighted proportions of the three models, while in In the actual application process, traditional human intervention weighted decision-making will destroy the end-to-end structure of deep learning, thus reducing the self-learning ability of deep learning itself; in addition, although this method uses three models of xgbootst, CNN, and LSTM, it is It simply combines its classification probabilities, and does not fully utilize the spatiotemporal characteristics of traffic to achieve classification

The disadvantage of this method is that it only combines all the spatial characteristics of the flow, and there is a certain lack of utilization of the time series characteristics of the flow itself, making it less accurate in classification and prone to misjudgment; this method requires artificial Extracting the characteristics of traffic requires a lot of labor and time, and it is impossible to classify end-to-end network traffic.

In summary, this method has great limitations when implementing encrypted malicious traffic detection

Images