Network data flow identification method and system based on wavelet analysis and support vector machine

Abstract

The invention provides a network data traffic identification method and system based on wavelet analysis and a support vector machine, and the method comprises the steps: S101, analyzing a pcap data packet, and carrying out the classification marking of the analyzed network traffic data through a KNN classification method; S102, processing the packet length sequence and the URL length sequence ofthe abnormal traffic data screened by the KNN classification method through a binary discrete wavelet transform algorithm to obtain a training feature set of the abnormal traffic data; S103, trainingan SVM classifier by taking the training feature set of the abnormal flow data as a training sample to obtain the SVM classifier; S104, adding the processed to-be-tested network flow data into an SVMclassifier to obtain a classification result. The method has the beneficial effects that binary discrete wavelet transform is used for processing a numerical sequence process, and effective time-frequency decomposition is carried out on a flow signal of a network, and is suitable for the field of network flow security.

Description

technical field [0001] The invention relates to the technical field of network flow data in a computer room of a power grid dispatching data center, in particular to a method and system for identifying network data flow based on wavelet analysis and support vector machines. Background technique [0002] The normal operation of the power grid dispatching data center plays a decisive role in the economic development and residents' life of a region or even the whole country. Any local problem may affect the normal operation of the entire data center or even the entire regional power grid. The measurement and prediction of network traffic is of great significance to the large-scale network management, planning and design of the power grid data dispatching center. The anomaly detection of network traffic can monitor whether the network is healthy, which is very important for ensuring the normal operation of the network system of the power grid data dispatching center. It is of gr...

AI Technical Summary

Problems solved by technology

The measurement and prediction of network traffic is of great significance to the large-scale network management, planning and design of the power grid data dispatching center. The anomaly detection of network traffic can monitor whether the network is healthy, which is very important for ensuring the normal operation of the network system of the power grid data dispatching center. It is of great significance and is also a key research direction in the field of network security. According to the current form, most network traffic detection systems are not perfect. In the prior art, continuous wavelet decomposition is used to detect the difference between normal and abnormal traffic signals in the frequency domain. difference, as the basis for detection, these detection algorithms are based on multiresolution analysis, which can perform an effective time-frequency decomposition of the signal, since its scale changes in a binary manner, its frequency resolution is poor in the high-frequency band, however, various anomalies There are various reasons for traffic generation, and the abnormality may be low-frequency or high-frequency

Therefore, these methods have the disadvantage of not being able to effectively detect anomalies in all frequency bands

Images