DFI network flow classification method based on bidirectional deep recurrent neural network

Abstract

The invention provides a DFI network flow classification method based on a bidirectional deep recurrent neural network, which comprises the following steps: inputting a message into a sample feature data extraction and classification module, generating a flow ID through hash calculation by taking a quintuple as a Key, and extracting key data flow by flow and message by the sample feature data extraction and classification module; performing classification and feature marking on each stream to obtain a traditional DPI identification classification mark, outputting the traditional DPI identification classification mark to a classification synthesizer, and outputting the traditional DPI identification classification mark to a DFI feature data filtering marking module for DFI feature data filtering marking; the DFI feature data filtering and marking module generates training data and real-time data; performing model parameter training on the bidirectional deep recurrent neural network to obtain a network traffic identification and classification result; and comprehensively processing to obtain a network flow classification result. According to the method, the LSTM is adopted as the bidirectional deep recurrent neural network model of the gating unit, the adaptability is wider, the precision is higher, and the error control rate is lower.

Description

Technical Field

[0001] The present invention relates to the technical field of network traffic classification, and in particular to a DFI network traffic classification method based on a bidirectional deep recurrent neural network. Background Art

[0002] With the rapid development of the Internet, network services and applications are changing with each passing day. At the same time, the identification, classification, statistics and control of Internet traffic are also the needs of operators and even national security. The premise of making network traffic visible, manageable and controllable is the identification and classification of network traffic. For network visualization systems, the identification and classification of network traffic is one of its most important functions and one of the most important core technologies. How to accurately and reliably identify and classify network traffic has always been one of the key topics in the relevant technical field. With the continuous development of the Internet and the continuous evolution of network security, more and more Internet applications use encryption algorithms such as HTTPS and various tunnel technologies. The traditional DPI technology-based method of identifying and classifying network traffic is increasingly unable to identify encrypted traffic. The network traffic classification method based on traditional DFI technology is simple and cannot obtain the deep-level characteristics and applications of network applications. The identification method generally has a high misidentification rate. Under the premise that encryption and tunneling technologies are increasingly used in Internet traffic, how to achieve the identification and classification of encrypted traffic is one of the technical problems that need to be solved in the research and development of the above-mentioned network traffic management platform equipment. Summary of the invention

[0003] In view of this, the problem to be solved by the present invention is to provide a DFI network traffic classification method based on a bidirectional deep recurrent neural network.

[0004] In order to solve the above technical problems, the technical solution adopted by the present invention is: a DFI network traffic classification method based on a bidirectional deep recurrent neural network, comprising: a message input to a sample feature data extraction and classification module, the message uses a five-tuple as a key, and generates a flow ID for marking a flow and corresponding to one by one through hash calculation, and the sample feature data extraction and classification module extracts relationship feature data, DPI feature data, DPI signaling feature data and DFI feature data flow by flow and message by message;

[0005] The relationship feature data, DPI feature data, and DPI signaling feature data are input into the traditional DPI classification and marking system, and the traditional DPI classification and marking system classifies and features each flow according to the above features to obtain the traditional DPI identification classification mark and outputs it to the classification integrator, and at the same time outputs it to the DFI feature data filtering and marking module for DFI feature data filtering and marking; the DFI feature data filtering and marking module generates training data and real-time data;

[0006] The training data output by the DFI feature data filtering and marking module is input into the bidirectional deep recurrent neural network for model parameter training;

[0007] The real-time data output by the DFI feature data filtering and marking module is used to identify and classify network traffic through a trained bidirectional deep recurrent neural network to obtain network traffic identification and classification results;

[0008] The network traffic identification and classification results obtained by the bidirectional deep recurrent neural network are comprehensively processed with the traditional DPI classification results to obtain the final network traffic classification results.

[0009] In the present invention, preferably, the bottom layer of the bidirectional deep recurrent neural network is a bidirectional recurrent neural network with a bidirectional LSTM as a basic unit, and a unidirectional LSTM is arranged on the upper layer to increase the depth of the bidirectional recurrent neural network.

[0010] In the present invention, preferably, the bidirectional LSTM concatenates its two hidden states at each time step as an input of the upper unidirectional LSTM at each time step, takes the hidden state of the upper unidirectional LSTM at the last time step, passes through a Dropout layer, and finally passes through a softmax layer to complete the classification of network traffic.

[0011] In the present invention, preferably, the function expression of the LSTM is:

[0012]

[0013] O t =σ(X t W xo +H t-1 W ho +b o )

[0014]

[0015] H t =O t ⊙tanh(C t )

[0016] Where: I t represents the input gate; F t Indicates forgetting the door; t represents the output gate; C t Represents a memory unit; ～ C t represents a candidate memory unit; H trepresents the hidden state; σ represents the sigmoid activation function; tanh represents the hyperbolic tangent function.

[0017] In the present invention, preferably, the updated hidden state of the bidirectional deep recurrent neural network is: t =φ(W hh h t-1 +W hx x t-1 +b h ); the output of the bidirectional deep recurrent neural network is: o t =φ(W ho h t +b o ).

[0018] In the present invention, preferably, the quintuple includes information source IP, destination IP, protocol type, source port, and destination port.

[0019] In the present invention, preferably, a 2×12 one-dimensional vector is extracted from each packet of the stream involved in the network traffic identification and classification as a feature parameter.

[0020] In the present invention, preferably, the softmax layer is implemented using a softamx activation function.

[0021] The advantages and positive effects of the present invention are as follows: based on the process of network traffic transmission, the way of transmitting information message by message is essentially a time series event triggering process. Each message arrives in a time sequence, and each message has a different message length, a different time interval, and a different instantaneous rate. These message-by-message characteristics are very similar to different words in a long sentence in text classification. Therefore, a bidirectional deep recurrent neural network model using LSTM (long short-term memory) as a gating unit is designed according to the characteristics of this time series, and this model is used to complete DFI-based network traffic classification with wider adaptability, higher accuracy, and lower error control rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0023] Figure 1 It is an overall architecture diagram of a DFI network traffic classification method based on a bidirectional deep recurrent neural network of the present invention;

[0024] Figure 2 It is an LSTM architecture diagram of a DFI network traffic classification method based on a bidirectional deep recurrent neural network of the present invention;

[0025] Figure 3 It is a schematic diagram of the difference between a shallow RNN and a deep RNN in a DFI network traffic classification method based on a bidirectional deep recurrent neural network of the present invention;

[0026] Figure 4 It is a deeper RNN structure schematic diagram of a DFI network traffic classification method based on a bidirectional deep recurrent neural network of the present invention;

[0027] Figure 5 It is a bidirectional RNN structure schematic diagram of a DFI network traffic classification method based on a bidirectional deep recurrent neural network of the present invention;

[0028] Figure 6 It is a schematic diagram of characteristic parameters of a DFI network traffic classification method based on a bidirectional deep recurrent neural network of the present invention;

[0029] Figure 7 It is a structural schematic diagram of a bidirectional recurrent neural network of a DFI network traffic classification method based on a bidirectional deep recurrent neural network of the present invention;

[0030] Figure 8 This is a traditional IP header message analysis diagram. DETAILED DESCRIPTION

[0031] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0032] It should be noted that when a component is referred to as being "fixed to" another component, it may be directly on the other component or there may also be a component centered. When a component is considered to be "connected to" another component, it may be directly connected to the other component or there may also be a component centered. When a component is considered to be "set on" another component, it may be directly set on the other component or there may also be a component centered. The terms "vertical", "horizontal", "left", "right" and similar expressions used herein are for illustrative purposes only.

[0033] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used herein in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The term "and / or" used herein includes any and all combinations of one or more related listed items.

[0034] DPI technology is a traffic detection and control technology based on the application layer, called "deep packet inspection". The so-called "depth" is compared with the ordinary message analysis level. Ordinary message detection only analyzes the content below the 4th layer of the IP packet, including the source address, destination address, source port, destination port and protocol type. Figure 8 The figure shows the traditional IP header message analysis.

[0035] In addition to the previous layer analysis, DPI also adds application layer analysis to identify various applications and their contents. When IP data packets, TCP or UDP data streams pass through a bandwidth management system based on DPI technology, the system reorganizes the application layer information in the OSI seven-layer protocol by deeply reading the content of the IP packet payload, thereby obtaining the content of the entire application program, and then shapes the traffic according to the management policy defined by the system.

[0036] DPI recognition technology can be divided into the following three categories:

[0037] (1) Identification method based on characteristic strings: Identification method based on "characteristic words" Different applications usually rely on different protocols, and different protocols have their own special fingerprints. These fingerprints may be specific ports, specific strings or specific bit sequences. The identification technology based on "characteristic words" determines the application carried by the service flow by detecting the "fingerprint" information in specific data packets in the service flow. According to the specific detection method, the identification technology based on "characteristic words" can be divided into three technologies: fixed position characteristic word matching, variable position characteristic matching and state characteristic matching. By upgrading the "fingerprint" information, the feature-based identification technology can easily expand its functions and realize the detection of new protocols. For example, the identification of the Bittorrent protocol is analyzed through reverse engineering methods. The so-called peer-to-peer protocol refers to the protocol for exchanging information between peers. The peer-to-peer protocol starts with a handshake, followed by a circular message stream. In front of each message, there is a number to indicate the length of the message. In the handshake process, 19 is sent first, followed by the string "BitTorrent protocol". Then "19BitTorrent Protocol" is the "characteristic word" of Bittorrent.

[0038] (2) Method based on signaling association: The control flow and business flow of some services are separated, and the business flow has no characteristics. In this case, a signaling association identification method is required. At this time, the DPI device needs to first identify the control flow, and parse it through a specific application layer gateway according to the protocol of the control flow, and identify the corresponding business flow from the protocol content. For each protocol, a different application layer gateway is required to analyze it. For example, SIP and H323 protocols belong to this type. SIP / H323 negotiates its data channel through the signaling interaction process, which is generally a voice stream encapsulated in RTP format. In other words, simply detecting the RTP stream cannot determine which protocol this RTP stream is established through. Only by detecting the protocol interaction of SIP / H323 can a complete analysis be obtained.

[0039] (3) User behavior pattern recognition method: The user behavior pattern recognition method is based on the analysis of the behavior that the terminal has already performed, and determines the action that the user is currently taking or about to take. Behavior pattern recognition technology is usually used to identify services that cannot be judged based on the protocol. For example, the SPAM (spam) service flow and the ordinary Email service flow are completely consistent in terms of the content of the Email. Only by analyzing the user behavior can the SPAM service be accurately identified.

[0040] like Figure 1 As shown, the present invention provides a DFI network traffic classification method based on a bidirectional deep recurrent neural network, including a message input to a sample feature data extraction and classification module, the message uses a five-tuple as a key, and generates a flow ID for marking a flow and corresponding to one by one through hash calculation, and the sample feature data extraction and classification module extracts relationship feature data, DPI feature data, DPI signaling feature data and DFI feature data flow by flow and message by message;

[0041] The relationship feature data, DPI feature data, and DPI signaling feature data are input into the traditional DPI classification and marking system, and the traditional DPI classification and marking system classifies and features each flow according to the above features to obtain the traditional DPI identification classification mark and outputs it to the classification integrator, and at the same time outputs it to the DFI feature data filtering and marking module for DFI feature data filtering and marking; the DFI feature data filtering and marking module generates training data and real-time data;

[0042] The training data output by the DFI feature data filtering and marking module is input into the bidirectional deep recurrent neural network for model parameter training;

[0043] The real-time data output by the DFI feature data filtering and marking module is used to identify and classify network traffic through a trained bidirectional deep recurrent neural network to obtain network traffic identification and classification results;

[0044] The network traffic identification and classification results obtained by the bidirectional deep recurrent neural network are comprehensively processed with the traditional DPI classification results to obtain the final network traffic classification results.

[0045] DFI uses application identification technology based on traffic behavior, that is, different application types are reflected in different states in session connections or data flows. For example, the characteristics of online IP voice traffic in terms of flow state are very obvious: the packet length of the RTP stream is relatively fixed, generally between 130 and 220 bytes, the connection rate is relatively low, at 20 to 84 kbit / s, and the session duration is relatively long; while the characteristics of the traffic model based on P2P download applications are that the average packet length is more than 450 bytes, the download time is long, the connection rate is high, and the preferred transport layer protocol is TCP. DFI technology is based on the behavioral characteristics of this series of traffic to establish a traffic feature model, and compares it with the traffic model by analyzing the packet length, connection rate, transmission byte volume, and interval between packets of the session connection flow, so as to identify the application type.

[0046] DFI only analyzes traffic behavior, so it can only generally classify application types. For example, applications that meet the P2P traffic model are uniformly identified as P2P traffic, and types that meet the network voice traffic model are uniformly classified as VOIP traffic, but it cannot determine whether the traffic uses H.323 or other protocols. If the data packet is transmitted encrypted, the flow control technology using the DPI method cannot identify its specific application, while the flow control technology using the DFI method is not affected because the state behavior characteristics of the application flow will not be fundamentally changed by encryption.

[0047] 1. Since the above-mentioned traditional DPI network traffic identification and classification methods are unable to identify and classify encrypted traffic, the relevant equipment systems will naturally focus on the identification and classification of encrypted network traffic using the DFI method.

[0048] 2. Traditional DFI traffic classification methods are often simple. Although they can classify encrypted network traffic, most of them have insufficient separation accuracy. Being able to classify 70-80% of encrypted traffic is already a good result. Even so, since the classification algorithm cannot extract the deep-level characteristics based on the flow, the classification results often have a high misjudgment rate. For the links that need to be controlled, it is very easy to cause miscontrol, leading to very serious consequences. How to design a DFI classification algorithm with greater adaptability and the ability to extract the deep-level characteristics of the flow is one of the core technical problems that need to be solved in network traffic classification and management related system equipment.

[0049] The present invention is based on the accumulation and analysis of the DFI characteristics of network traffic, and selects more representative DFI characteristic parameters from a large number of characteristic parameters. At the same time, based on the process of network traffic transmission, the way of transmitting information message by message is essentially a time series event triggering process. Each message arrives in a time sequence, and each message has a different message length, a different time interval, and a different instantaneous rate. These message-by-message characteristics are very similar to the different words in a long sentence in text classification. Therefore, a bidirectional deep recurrent neural network model using LSTM (long short-term memory) as the gating unit is designed according to the characteristics of this time series, and this model is used to complete the DFI-based network traffic classification with wider adaptability, higher accuracy, and lower error control rate.

[0050] This application proposal deeply studies the flow characteristics of network traffic based on DFI. Based on the sequence characteristics and time characteristics of the DFI characteristics of network traffic and on the basis of a deep understanding of the characteristics of recurrent neural networks, it designs and plans to use a deep recurrent neural network model to identify and classify DFI network traffic.

[0051] In this embodiment, further, the bottom layer of the bidirectional deep recurrent neural network is a bidirectional recurrent neural network with a bidirectional LSTM as a basic unit, and a unidirectional LSTM is set on the upper layer to increase the depth of the bidirectional recurrent neural network.

[0052] like Figure 2 As shown, in this embodiment, further, the bidirectional LSTM concatenates its two hidden states at each time step as an input of the upper unidirectional LSTM at each time step, takes the hidden state of the last time step of the upper unidirectional LSTM, passes through a Dropout layer, and finally passes through a softmax layer to complete the classification of network traffic.

[0053] In this embodiment, further, the function expression of the LSTM is:

[0054]

[0055] O t =σ(X t W xo +H t-1 W ho +b o )

[0056]

[0057] H t =O t ⊙tanh(C t )

[0058] Where: I t represents the input gate; F t Indicates forgetting the door; t represents the output gate; C t Represents a memory unit; ~C t represents a candidate memory unit; H t represents the hidden state; σ represents the sigmoid activation function; tanh represents the hyperbolic tangent function.

[0059] In this embodiment, further, the updated hidden state of the bidirectional deep recurrent neural network is: t =φ(W hh h t-1 +W hx x t-1 +b h ); the output of the bidirectional deep recurrent neural network is: o t =φ(W ho h t +b o ).

[0060] like Figure 3 , Figure 4 and Figure 5 As shown in Figure 1, the bidirectional RNN consists of a forward RNN hidden layer and a backward RNN hidden layer. After the input sample passes through the two RNNs, the two hidden states are merged to get the output.

[0061] The extraction of feature parameters is the key to whether the artificial intelligence neural network algorithm can achieve the design goal. Based on the in-depth understanding of network traffic characteristics, the feature parameters extracted and the organization method of the present invention are very different from other similar DFI methods. The present invention extracts a 2x12 one-dimensional vector as a feature parameter for each packet involved in identification and classification. The specific parameters are as follows Figure 6 shown.

[0062] Among them, the uplink direction / downlink direction: the value is 0 or 1, and "1" means that the current message is in this direction.

[0063] Protol: The value of the IP header protocol field, indicating that the flow is TCP, UDP, ICMP, etc.

[0064] Number of packet tunnel layers: The value can be 0 / 1 / 2, etc. 0 means no tunnel, and N means N-layer tunnel packets.

[0065] TCP_Flag: When the message protocol is TCP, the value is the Flag field in the TCP header

[0066] Windows: When the message protocol is TCP, the value of the TCP header TCP transmission window Windows field is taken.

[0067] Message arrival time: The first message arrival time is 0, and subsequent messages record the real-time message arrival time with an accuracy of microseconds.

[0068] Message arrival interval: records the time interval between adjacent messages in the same direction, with an accuracy of microseconds.

[0069] Message length: The length of the complete message, including the MAC header and CRC field, in bytes.

[0070] Payload length: The actual length of the payload transmitted in the message, in bytes.

[0071] Message payload rate: The message payload rate is the instantaneous rate obtained by dividing the message payload length by the message arrival interval in the same direction.

[0072] Cumulative payload length: The cumulative message payload length from the first message to the current message.

[0073] Cumulative static load rate: The cumulative static load rate is obtained by dividing the cumulative message static load length by the current message arrival time.

[0074] The above DFI feature parameters need to be normalized before input; when calculating the bidirectional recurrent network, the 2x12 DFI feature vector can be transposed into a 1x24 one-dimensional vector for calculation.

[0075] In this embodiment, further, the quintuple includes information source IP, destination IP, protocol type, source port, and destination port.

[0076] In this embodiment, further, a 2×12 one-dimensional vector is extracted from each packet of the flow involved in the network traffic identification and classification as a feature parameter.

[0077] In this embodiment, further, the softmax layer is implemented using a softamx activation function.

[0078] like Figure 7 As shown, the network model of the present invention is characterized in that the bottom layer is a bidirectional recurrent neural network with a bidirectional LSTM as the basic unit, and a unidirectional LSTM is added on this basis to increase the depth of the bidirectional recurrent neural network. Due to the capacity of the recurrent neural network for information transmission and the problem of gradient disappearance, only short-distance dependencies can be established. In order to establish long-distance dependencies, the number of network layers can be increased or a fully connected network can be used. However, the fully connected network cannot handle variable-length input sequences. In addition, the size of the connection weights is different for different input lengths. For this reason, the scheme adds a self-attention model on top of the bidirectional recurrent neural network to "dynamically" generate the weights of different connections to solve the above problems.

[0079] The present invention is characterized in that the depth of the recurrent neural network can be increased conveniently by increasing the number of layers of the bidirectional recurrent neural network and the unidirectional LSTM recurrent neural network, and the accuracy of classification can be improved by appropriately increasing the depth. The two hidden states of the bidirectional LSTM at each time step are spliced ​​as an input at each time step of the upper unidirectional LSTM, and finally the hidden state at the last time step of the upper unidirectional LSTM is taken, and then a Dropout layer is passed, and finally a softmax layer (using a softamx activation function) is passed to complete the classification of network traffic.

[0080] The design of the present invention is characterized in that LSTM is used as the core unit, and a bidirectional deep RNN model is used to capture long-distance dependencies in flow-based message sequences to complete network traffic classification based on DFI characteristics.

[0081] The present invention starts with the analysis of network traffic characteristics and features, divides the characteristics of network traffic into characteristics of space and time dimensions, and designs a spatial dimension feature extraction model based on convolutional neural network and a temporal dimension feature extraction model based on recurrent neural network for reference to network traffic characteristics of different dimensions. At the same time, the entire model framework is designed to realize the model of explicit features such as protocol signatures by encoding and decoding, and realizes the Client / Server relationship model based on network traffic. The present invention provides a feasible design method for the identification and classification of Internet traffic, which currently accounts for an increasing proportion of encrypted traffic.

[0082] The embodiments of the present invention are described in detail above, but the contents described are only preferred embodiments of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of this patent.

Claims

1. A DFI network traffic classification method based on a bidirectional deep recurrent neural network, characterized in that: The steps include: The message is input into the sample feature data extraction and classification module. The message uses the five-tuple as the key, and generates a flow ID for marking a flow and corresponding to one of them through hash calculation. The sample feature data extraction and classification module extracts relationship feature data, DPI feature data, DPI signaling feature data and DFI feature data for each flow and each message. The relationship feature data, DPI feature data, and DPI signaling feature data are input into the traditional DPI classification and marking system, and the traditional DPI classification and marking system classifies and features each flow according to the above features to obtain the traditional DPI identification classification mark and outputs it to the classification integrator, and at the same time outputs it to the DFI feature data filtering and marking module for DFI feature data filtering and marking; the DFI feature data filtering and marking module generates training data and real-time data; The training data output by the DFI feature data filtering and marking module is input into the bidirectional deep recurrent neural network for model parameter training; The real-time data output by the DFI feature data filtering and marking module is used to identify and classify network traffic through a trained bidirectional deep recurrent neural network to obtain network traffic identification and classification results; The network traffic identification and classification results obtained by the bidirectional deep recurrent neural network are comprehensively processed with the traditional DPI classification results to obtain the final network traffic classification results.

2. According to claim 1, a DFI network traffic classification method based on a bidirectional deep recurrent neural network is characterized in that: The bottom layer of the bidirectional deep recurrent neural network is a bidirectional recurrent neural network with a bidirectional LSTM as a basic unit, and a unidirectional LSTM is set on the upper layer to increase the depth of the bidirectional recurrent neural network.

3. According to claim 1, a DFI network traffic classification method based on a bidirectional deep recurrent neural network is characterized in that: The bidirectional LSTM concatenates its two hidden states at each time step as an input to the upper unidirectional LSTM at each time step, takes the hidden state of the upper unidirectional LSTM at the last time step, passes through a Dropout layer, and finally passes through a softmax layer to complete the classification of network traffic.

4. According to claim 1, a DFI network traffic classification method based on a bidirectional deep recurrent neural network is characterized in that: The function expression of the LSTM is: Among them I t represents the input gate; F t Indicates forgetting the door; t represents the output gate; C t Represents a memory unit; ~C t represents a candidate memory unit; H t represents the hidden state; σ represents the sigmoid activation function; tanh represents the hyperbolic tangent function.

5. According to claim 1, a DFI network traffic classification method based on a bidirectional deep recurrent neural network is characterized in that: The updated hidden state of the bidirectional deep recurrent neural network is: t =φ(W hh h t-1 +W hx x t-1 +b h ); the output of the bidirectional deep recurrent neural network is: o t =φ(W ho h t +b o ).

6. According to claim 1, a DFI network traffic classification method based on a bidirectional deep recurrent neural network is characterized in that: The five-tuple includes information source IP, destination IP, protocol type, source port, and destination port.

7. According to claim 1, a DFI network traffic classification method based on a bidirectional deep recurrent neural network is characterized in that: A 2×12 one-dimensional vector is extracted from each packet of the flow involved in the network traffic identification and classification as a feature parameter.

8. According to claim 1, a DFI network traffic classification method based on a bidirectional deep recurrent neural network is characterized in that: The softmax layer is implemented using the softamx activation function.

Images