Rule type application traffic classification method and system based on model interpretation

Abstract

The invention discloses a rule type application traffic classification method and system based on model interpretation. The method comprises a construction stage and a classification stage. The construction stage comprises the following steps: uniformly processing application traffic samples of known types; training and tuning the deep learning model; analyzing the trained and optimized deep learning model through a model explanation-based method, and performing rule screening on a model explanation result to obtain a classification rule set; the classification stage comprises the steps of uniformly processing to-be-classified application traffic; and performing strategy matching on the to-be-classified application traffic, and outputting a judgment result. According to the method and the system, knowledge automatically learned from training data by a deep learning model is represented in a weighted rule mode, and application traffic classification is carried out by using strategy rule matching on the basis, so that high-accuracy and high-efficiency application traffic classification is realized.

Description

technical field [0001] The invention relates to using a model interpretation method to generate feature matching rules to automatically classify mixed application traffic by approximate replacement of deep learning technology, and particularly relates to a rule-based application traffic classification method and system based on model interpretation. Background technique [0002] Application traffic classification is the process of associating application traffic with the specific application protocol or application it generates. Specifically, in network management, in order to obtain better network service quality and network provisioning, network operators first need to divide traffic into different applications or application protocols. Also, in the field of network security, application traffic classification is the first step in activities such as anomaly detection, building network firewalls, and filtering unwanted traffic. Due to this application demand, research in t...

AI Technical Summary

Problems solved by technology

The deep learning model needs to build the relationship between the input data and the target result, but the relationship between the input data and the target result is usually difficult to judge directly, so the deep learning model often needs to use a large number of learnable parameters and design complex models structure for high-accuracy classification

However, the real-time classification scenario of application traffic requires high classification efficiency. Deploying a deep learning classification scheme requires a large number of new computing resources, and it is difficult to afford the classification requirements of massive application traffic.

[0005] (2) The judgment basis and credibility of the deep learning model for classification are difficult to intuitively display, so it is difficult to apply to scenarios with high reliability requirements

The classification process of the deep learning model is encapsulated in a complex model structure and a large number of model parameters, which makes it difficult to directly analyze the reasoning process of the deep learning model, so it is difficult to judge whether the reasoning of the deep learning model is based on effective features and whether the results are reliable and qualified. Versatility

Images