Unknown traffic data identification method and device based on dynamic network environment

Abstract

The invention relates to an unknown traffic data identification method and device based on a dynamic network environment. The method comprises the following steps of: classifying known traffic in network data by utilizing a known network traffic classification model, performing preliminary judgment according to a classification prediction result, and classifying the category of unknown traffic data for the network data which is preliminarily judged to be unknown traffic number by utilizing a self-adaptive clustering method; identifying each category through a similarity coefficient estimation method so as to identify the category belonging to malicious traffic and the category belonging to normal traffic, namely further understanding and learning unknown traffic data, and converting the unknown traffic data into known traffic data; and training and updating the known network traffic classification model again by using the new known traffic data. By adopting the method, known traffic data can be classified and unknown traffic data can be identified in a dynamic network environment which changes rapidly at present.

Description

technical field [0001] The present application relates to the technical field of network data identification, in particular to a method and device for identifying unknown traffic data based on a dynamic network environment. Background technique [0002] In recent years, with the rapid development of the Internet, network traffic has experienced explosive growth, and Internet access traffic has grown rapidly. However, the rapid development has brought greater challenges to network security. The growth of network traffic makes unknown traffic mixed in the network traffic data flow. There may be threatening and malicious traffic in the unknown traffic, which poses a huge threat to the user's network security. Its hidden dangers cannot be underestimated. Therefore, the identification and analysis of unknown traffic, especially unknown malicious traffic, has become an important research topic. Existing identification schemes use port-based traffic identification technology, mac...

AI Technical Summary

Problems solved by technology

In closed-world problems, existing research methods can achieve high traffic classification accuracy, but in the real world, network applications have a large amount of data, and will continue to be updated with the development of the network. It is unknown. Whenever a new application appears, the accuracy of the existing model will be greatly affected, resulting in a decrease in the identification efficiency of unknown traffic, and even threatening network security.

Images