A DFI network traffic classification method based on a bidirectional deep recurrent neural network

Abstract

The application provides a DFI network flow classification method based on a bidirectional deep recurrent neural network, which comprises the following steps: inputting a message to a sample feature data extraction and classification module, generating a flow ID by hash calculation with a five-tuple as a Key, and extracting key data by the sample feature data extraction and classification module flow by flow and message by message; classifying and marking features flow by flow to obtain a traditional DPI identification classification mark and outputting the mark to a classification synthesizer, and simultaneously outputting the mark to a DFI feature data filtering and marking module to perform DFI feature data filtering and marking; the DFI feature data filtering and marking module generates training data and real-time data; model parameter training is performed on a bidirectional deep recurrent neural network to obtain a network flow identification and classification result; and a network flow classification result is obtained through comprehensive processing. The bidirectional deep recurrent neural network model with LSTM as a gating unit has wider adaptability, higher precision and lower error control rate.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network traffic classification, and particularly relates to a DFI network traffic classification method based on a bidirectional deep recurrent neural network. BACKGROUND

[0002] With the rapid development of the Internet, network services and applications are changing rapidly, and the identification, classification, statistics and control of Internet traffic are also the needs of operators and even national security, and the premise of the visibility, manageability and controllability of network traffic is the identification and classification of network traffic. For a network visualization system, the identification and classification of network traffic is one of the most important functions and one of the most important core technologies. How to accurately and reliably identify and classify network traffic has always been one of the key topics in the relevant technical field. With the continuous development of the Internet and the continuous evolution of network security, more and more Internet applications use encryption algorithms such as HTTPS and various tunnel technologies. The traditional DPI technology-based method of scanning similar feature strings cannot identify and classify encrypted traffic. The network traffic classification method based on the traditional DFI technology cannot obtain deep features and applications of network applications, and the identification method generally has a high misidentification rate. Under the premise that Internet traffic is increasingly encrypted and tunneled, how to identify and classify encrypted traffic is one of the technical problems that need to be solved in the development of the above network traffic management platform device. SUMMARY

[0003] Therefore, the present application aims to solve the problem of providing a DFI network traffic classification method based on a bidirectional deep recurrent neural network.

[0004] To solve the above technical problems, the technical solution adopted by the present application is: a DFI network traffic classification method based on a bidirectional deep recurrent neural network, which comprises a message input to a sample feature data extraction and classification module. The message uses a five-tuple as a Key, and a flow ID is generated for marking a flow and corresponding to one flow by hash calculation. The sample feature data extraction and classification module extracts relationship feature data, DPI feature data, DPI signaling feature data and DFI feature data for each flow and each message.

[0005] The relationship feature data, the DPI feature data and the DPI signaling feature data are input to a traditional DPI classification and marking system. The traditional DPI classification and marking system classifies and marks the features according to the above-mentioned features to obtain traditional DPI identification and classification marking, and outputs the traditional DPI identification and classification marking to a classification synthesizer and a DFI feature data filtering and marking module at the same time. The DFI feature data filtering and marking module generates training data and real-time data.

[0006] The training data output by the DFI feature data filtering and labeling module is input into a bidirectional deep recurrent neural network for model parameter training.

[0007] The real-time data output by the DFI feature data filtering and labeling module is used to identify and classify network traffic through a trained bidirectional deep recurrent neural network to obtain network traffic identification and classification results.

[0008] The network traffic identification and classification results obtained through the bidirectional deep recurrent neural network are combined with the traditional DPI classification results to obtain the final network traffic classification result.

[0009] In this invention, preferably, the bottom layer of the bidirectional deep recurrent neural network is a bidirectional recurrent neural network based on a bidirectional LSTM, and a unidirectional LSTM is set in the upper layer to increase the depth of the bidirectional recurrent neural network.

[0010] In this invention, preferably, the bidirectional LSTM concatenates its two hidden states at each time step as an input to the upper unidirectional LSTM at each time step, takes the hidden state at the last time step of the upper unidirectional LSTM, passes through a Dropout layer, and finally passes through a softmax layer to complete the classification of network traffic.

[0011] In this invention, preferably, the function expression of the LSTM is:

[0012]

[0013] in: Indicates the input gate; It means I forgot the door; Indicates the output gate; Represents a memory unit; Indicates candidate memory units; Indicates a hidden state; This represents the sigmoid activation function; Indicates the hyperbolic tangent function; Indicates a given time step Input time; , , They represent the inputs respectively. Weight parameters for the input gate, forget gate, and output gate; express The hidden state at any given moment; , , They represent the corresponding weight parameters of input gate, forget gate, output gate, memory cell; denotes weight parameters of input gate, forget gate, output gate, memory cell; denotes denotes candidate memory cell at time t; denotes element-wise multiplication operation; , , , denote bias parameters of input gate, forget gate, output gate, memory cell operation at time t.

[0014] In the application, preferably, the updated hidden state of the bidirectional deep recurrent neural network is: ,

[0015] wherein, denotes hidden state; denotes activation function; denotes weight parameters of hidden state; denotes hidden state at time t; denotes weight parameters of input at time t; denotes input at time t; denotes hidden state bias parameters; input; denotes hidden state bias parameters;

[0016] The output of the bidirectional deep recurrent neural network is:

[0017] ,

[0018] wherein, denotes activation function; denotes hidden state; denotes weight parameters of hidden state at output state; denotes bias parameters of output gate operation at time t.

[0019] In the application, preferably, the five-tuple includes information source IP, destination IP, protocol type, source port and destination port.

[0020] In the application, preferably, a 2x12 one-dimensional vector is extracted as a feature parameter for each packet of the flow participating in the network traffic identification and classification.

[0021] In the application, preferably, the softmax layer is implemented by using softamx activation function.

[0022] The application has the advantages and positive effects that: based on the network flow transmission process, the message transmission mode of each message is essentially a time sequence event triggering process, each message is sequentially arrived by time, each message has different message length, different time interval and different instantaneous rate, and these message-by-message characteristics are very similar to different words in a long sentence in text classification; therefore, the bidirectional deep recurrent neural network model using LSTM (Long Short Term Memory) as a gating unit is designed according to the characteristics of the time sequence, and the network flow classification based on DFI with wider adaptability, higher precision and lower error rate is completed by using the model. BRIEF DESCRIPTION OF DRAWINGS

[0023] The accompanying drawings are included to provide a further understanding of the application and are incorporated in and constitute a part of this specification, illustrate embodiments of the application and are used to explain the application, and do not constitute a limitation of the application. In the drawings:

[0024] Figure 1 is a whole architecture diagram of a DFI network flow classification method based on a bidirectional deep recurrent neural network of the application;

[0025] Figure 2 is an LSTM architecture diagram of a DFI network flow classification method based on a bidirectional deep recurrent neural network of the application;

[0026] Figure 3 is a difference schematic diagram of a shallow RNN and a deep RNN of a DFI network flow classification method based on a bidirectional deep recurrent neural network of the application;

[0027] Figure 4 is a deeper RNN structure schematic diagram of a DFI network flow classification method based on a bidirectional deep recurrent neural network of the application;

[0028] Figure 5 is a bidirectional RNN structure schematic diagram of a DFI network flow classification method based on a bidirectional deep recurrent neural network of the application;

[0029] Figure 6 is a feature parameter schematic diagram of a DFI network flow classification method based on a bidirectional deep recurrent neural network of the application;

[0030] Figure 7 is a bidirectional recurrent neural network structure schematic diagram of a DFI network flow classification method based on a bidirectional deep recurrent neural network of the application;

[0031] Figure 8 is a traditional IP header message analysis diagram. DETAILED DESCRIPTION

[0032] With reference to the drawings, the technical solutions in the embodiments of the present application will be fully and completely described below. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments of the present application, all the other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0033] It should be noted that when a component is referred to as being "fixed" to another component, it can be directly on the other component or intervening components can also be present. When a component is referred to as being "connected" to another component, it can be directly connected to the other component or intervening components can also be present. When a component is referred to as being "disposed" on another component, it can be directly on the other component or intervening components can also be present. The terms "vertical", "horizontal", "left", "right", and similar terms as used herein are for illustrative purposes only.

[0034] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used in the description herein is for describing particular embodiments only and is not intended to be limiting of the application. As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0035] DPI technology is an application layer based traffic detection and control technology, referred to as "deep packet inspection". The so-called "deep" is compared with the normal message analysis level, the normal message detection only analyzes the content of the IP packet below the 4th layer, including the source address, the destination address, the source port, the destination port and the protocol type. For example, Figure 8 The traditional IP header message analysis is shown.

[0036] And DPI, in addition to the analysis of the previous level, also increases the application layer analysis, to identify various applications and their content. When the IP packet, TCP or UDP data stream passes through the bandwidth management system based on DPI technology, the system reorganizes the application layer information in the OSI seven-layer protocol by deeply reading the content of the IP packet load, so as to obtain the content of the entire application program, and then performs shaping operation on the traffic according to the management policy defined by the system.

[0037] The identification technology of DPI can be divided into the following three categories:

[0038] (1) Feature string based recognition method: Different applications based on "feature string" recognition method usually depend on different protocols, and different protocols have their special fingerprints, which can be specific ports, specific strings or specific Bit sequences. The "feature string" based recognition technology determines the application carried by the service flow by detecting the "fingerprint" information in specific data packets in the service flow. According to the specific detection method, the "feature string" based recognition technology can be divided into three technologies: fixed position feature string matching, variable position feature matching and state feature matching. Through the upgrade of "fingerprint" information, the feature-based recognition technology can be easily expanded to detect new protocols. For example: Bittorrent protocol recognition, through the method of reverse engineering, the peer-to-peer protocol is analyzed. The peer-to-peer protocol refers to the protocol for exchanging information between peers. The peer-to-peer protocol starts with a handshake, followed by a circular message stream, and each message has a number at the front to indicate the length of the message. In its handshake process, 19 is sent first, followed by the string "BitTorrent protocol". Then "19 BitTorrent Protocol" is the "feature string" of Bittorrent.

[0039] (2) Signaling association based method: The control flow and service flow of some services are separated, and the service flow has no characteristics. In this case, the signaling association recognition method needs to be used. At this time, the DPI device needs to identify the control flow first, and then analyze it through a specific application layer gateway according to the protocol of the control flow, and identify the corresponding service flow from the protocol content. For each protocol, a different application layer gateway is needed to analyze it. For example, SIP and H323 protocols belong to this type. SIP / H323 obtains its data channel through signaling interaction process, which is usually RTP format encapsulated voice stream. That is, pure RTP flow detection cannot determine that this RTP flow is established by which protocol. Only by detecting the SIP / H323 protocol interaction can the complete analysis be obtained.

[0040] (3) User behavior pattern recognition method: User behavior pattern recognition method is based on the analysis of the behavior implemented by the terminal to determine the action being performed by the user or the action to be implemented. Behavior pattern recognition technology is usually used for the recognition of services that cannot be determined by protocol. For example: SPAM (spam) service flow and ordinary Email service flow are completely consistent in terms of Email content, and only through the analysis of user behavior can SPAM service be accurately recognized.

[0041] For example Figure 1As shown, the application provides a DFI network traffic classification method based on a bidirectional deep recurrent neural network, which comprises a packet inputting to a sample feature data extraction and classification module, the packet taking a five-tuple as a Key, and generating a flow ID for marking a flow and corresponding to the flow ID through hash calculation, the sample feature data extraction and classification module extracting relationship feature data, DPI feature data, DPI signaling feature data and DFI feature data flow by flow and packet by packet;

[0042] The relationship feature data, the DPI feature data and the DPI signaling feature data are input to a conventional DPI classification marking system, the conventional DPI classification marking system classifies and marks features flow by flow according to the above features to obtain conventional DPI identification classification marking and output the conventional DPI identification classification marking to a classification synthesizer and a DFI feature data filtering marking module at the same time, the DFI feature data filtering marking module generates training data and real-time data;

[0043] The training data output by the DFI feature data filtering marking module is input to a bidirectional deep recurrent neural network for model parameter training;

[0044] The real-time data output by the DFI feature data filtering marking module is subjected to network traffic identification and classification through the trained bidirectional deep recurrent neural network to obtain network traffic identification and classification results;

[0045] The network traffic identification and classification results obtained through the bidirectional deep recurrent neural network are comprehensively processed with conventional DPI classification results to obtain final network traffic classification results.

[0046] DFI adopts an application recognition technology based on traffic behavior, that is, different application types are different in the state of session connection or data flow. For example, the characteristics of online IP voice traffic on the flow state are very obvious: the packet length of the RTP flow is relatively fixed, generally 130-220 bytes, the connection rate is low, 20-84 kbit / s, and the session duration is relatively long; the traffic model of the P2P download application is characterized by an average packet length of more than 450 bytes, long download time, high connection rate, and TCP as the preferred transport layer protocol. The DFI technology is based on a series of traffic behavior characteristics to establish a traffic feature model, compare the packet length, connection rate, transmission byte amount, and packet-to-packet interval of the session connection flow with the traffic model, and thus identify the application type.

[0047] DFI is only for traffic behavior analysis, so it can only make a rough classification of application types, such as identifying applications that meet the P2P traffic model as P2P traffic and identifying types that meet the network voice traffic model as VOIP traffic, but it cannot determine whether the traffic uses H.323 or other protocols. If the data packet is transmitted by encryption, the flow control technology using the DPI method cannot identify the specific application, but the flow control technology using the DFI method is not affected because the state behavior characteristics of the application flow do not fundamentally change due to encryption.

[0048] 1. Since the traditional DPI-based network traffic identification and classification method cannot identify and classify encrypted traffic, the related device system naturally focuses on the identification and classification of encrypted network traffic using the DFI method.

[0049] 2. The traditional DFI traffic classification method is often simple, and although it can classify encrypted network traffic, most of them have insufficient separation precision, and it is already a good result to classify 70-80% of encrypted traffic. Even so, due to the inability of the classification algorithm to extract deep features based on the flow, the results of the classification often have a high misjudgment rate, and for links that need to be controlled, it is easy to produce miscontrol, leading to very serious consequences. How to design a DFI classification algorithm with greater adaptability and the ability to extract deep features of the flow is one of the core technical problems that network traffic classification and management related system devices need to solve.

[0050] Based on the accumulation and analysis of the DFI characteristics of network traffic, the application selects more representative DFI characteristic parameters from a large number of characteristic parameters. At the same time, based on the fact that the message transmission process in network traffic transmission is essentially a time series event triggered process, each message arrives in time sequence, each message has different message length, different time interval and different instantaneous rate, these message-by-message characteristics are very similar to different words in a long sentence in text classification. Therefore, a bidirectional deep recurrent neural network model using LSTM (Long Short Term Memory) as a gating unit is designed for the time series characteristics, and this model is used to complete the DFI-based network traffic classification with greater adaptability, higher precision and lower miscontrol rate.

[0051] Based on the deep research on the DFI-based flow characteristics of network traffic, the application proposal is designed and planned to use a deep recurrent neural network model for DFI network traffic identification and classification based on the sequence characteristics and time characteristics of the DFI characteristics of network traffic and the deep understanding of the characteristics of the recurrent neural network.

[0052] In the embodiment, further, the bottom layer of the bidirectional deep recurrent neural network is a bidirectional recurrent neural network with bidirectional LSTM as the basic unit, and a unidirectional LSTM is arranged in the upper layer to increase the depth of the bidirectional recurrent neural network.

[0053] As shown in the embodiment, further, the bidirectional LSTM splices two hidden states thereof at each time step as an input of the unidirectional LSTM at each time step, takes the hidden state at the last time step of the unidirectional LSTM, and finally completes the classification of the network traffic through a Dropout layer and a softmax layer. Figure 2

[0054] In the embodiment, further, the function expression of the LSTM is as follows:

[0055]

[0056] wherein: input gate is represented by forget gate is represented by output gate is represented by memory cell is represented by candidate memory cell is represented by hidden state is represented by sigmoid activation function is represented by hyperbolic tangent function is represented by input at a given time step is represented by , , , weight parameters under the input gate, the forget gate and the output gate are represented by , hidden state at the time t is represented by , , , weight parameters under the input gate, the forget gate and the output gate corresponding to the hidden state are represented by , weight parameter of the input memory cell is represented by , weight parameter of the candidate memory cell hidden state is represented by , candidate memory cell at the time t is represented by element-wise multiplication operation is represented by , , , bias parameters of the input gate, the forget gate, the output gate and the memory cell operation at the time t are represented by ​

[0057] In the embodiment, further, the updated hidden state of the bidirectional deep recurrent neural network is:

[0058] ,

[0059] wherein, represents the hidden state; represents an activation function; represents a weight parameter of the hidden state; represents the hidden state at the time point t; represents the input at the time point t; represents the input at the time point t; represents a bias parameter of the hidden state;

[0060] The output of the bidirectional deep recurrent neural network is:

[0061] ,

[0062] wherein, represents an activation function; represents the hidden state; represents a weight parameter of the hidden state at the output state; represents a bias parameter at the output gate operation time point.

[0063] As shown in Figure 3 , Figure 4 and Figure 5 , the bidirectional RNN is composed of a forward RNN hidden layer and a backward RNN hidden layer. The input sample is combined after passing through the two RNNs to obtain the output.

[0064] The extraction of the feature parameter is a key to whether the artificial intelligence neural network algorithm can achieve the design target. Based on the deep understanding of the network traffic characteristics, the feature parameters and the organization mode extracted by the application are very different from other similar DFI methods. The application extracts a 2x12 one-dimensional vector as the feature parameter for each message of the flow participating in identification and classification, and the specific parameters are as shown in Figure 6 .

[0065] Wherein, the uplink / downlink: the value is 0 or 1, and “1” indicates that the current message is in this direction.

[0066] Protol: the value is the IP header protocol field, indicating that the flow is TCP, UDP, ICMP, etc.

[0067] Message tunnel layer: the value is 0 / 1 / 2, etc., 0 represents no tunnel, and N represents N-layer tunnel message.

[0068] TCP_Flag: When the message protocol is TCP, the value is the TCP header Flag field

[0069] Windows: When the message protocol is TCP, the value is the TCP header TCP transmission window Windows field.

[0070] Message arrival time: the first message arrival time is 0, and the real-time message arrival time of subsequent messages is recorded, with a precision of microseconds.

[0071] Message arrival interval: the time interval between adjacent messages in the same direction is recorded, with a precision of microseconds.

[0072] Message length: the length of the completed message, including the MAC header and the CRC field, in bytes.

[0073] Static load length: the actual static load length of the message, in bytes.

[0074] Message static load rate: the message static load rate is the instantaneous rate obtained by dividing the message static load length by the message arrival interval in the same direction.

[0075] Cumulative static load length: from the first message to the current message, the cumulative message static load length is obtained.

[0076] Cumulative static load rate: the cumulative static load rate obtained by dividing the cumulative message static load length by the current message arrival time.

[0077] The above DFI feature parameters need to be normalized before input; when the bidirectional recurrent network is calculated, the 2x12 DFI feature vector can be transposed into a 1x24 one-dimensional vector for calculation.

[0078] In this embodiment, further, the five-tuple includes information source IP, destination IP, protocol type, source port, and destination port.

[0079] In this embodiment, further, a 2x12 one-dimensional vector is extracted as a feature parameter for each message of the flow participating in the network traffic identification and classification.

[0080] In this embodiment, further, the softmax layer is implemented using a softamx activation function.

[0081] As Figure 7As shown, the feature of the network model of the application is that the bottom layer is a bidirectional recurrent neural network with bidirectional LSTM as the basic unit, and a unidirectional LSTM is added on this basis to increase the depth of the bidirectional recurrent neural network. Due to the capacity of information transmission and the gradient disappearance problem of the recurrent neural network, only short distance dependent relationship can be established in practice. In order to establish long distance dependent relationship, the number of layers of the network can be increased or a fully connected network can be used. However, the fully connected network cannot process variable length input sequence, and in addition, the size of the connection weight is different for different input lengths. Therefore, in the scheme, a self-attention model is added on the bidirectional recurrent neural network to "dynamically" generate different connection weights, solving the above problems.

[0082] The feature of the application is that the depth of the recurrent neural network can be increased by conveniently increasing the number of layers of the bidirectional recurrent neural network and the unidirectional LSTM recurrent neural network, and the classification accuracy can be improved by appropriately increasing the depth. The two hidden states of the bidirectional LSTM at each time step are spliced as an input of the upper unidirectional LSTM at each time step, and the hidden state at the last time step of the upper unidirectional LSTM is taken, and then a Dropout layer is passed, and finally a softmax layer (using softamx activation function) is passed to complete the classification of network traffic.

[0083] The feature of the design of the application is that LSTM is used as the core unit, and long distance dependent relationship in the flow-based message sequence is captured through a bidirectional deep RNN model to complete network traffic classification based on DFI characteristics.

[0084] The application is based on analysis of network traffic characteristics and features, and divides the features of network traffic into spatial and temporal dimensions. For different dimensional network traffic features, the idea of multi-modal artificial intelligence is used to design a spatial dimensional feature extraction model mainly using convolutional neural network, and a temporal dimensional feature extraction model mainly using recurrent neural network. At the same time, the entire model framework uses an encoding and decoding method to realize a model of explicit features such as protocol feature words, and realizes a Client / Server relationship model based on network traffic. The application provides a feasible design method for current Internet traffic recognition and classification with increasing proportion of encrypted traffic.

[0085] The embodiments of the application are described in detail above, but the content described is only the preferred embodiments of the application and cannot be considered as limiting the scope of the implementation of the application. Any equivalent changes and improvements made within the scope of the application should still belong to the scope covered by the patent.

Claims

1. A DFI network traffic classification method based on bidirectional deep recurrent neural network, characterized in that, The method comprises the following steps: The packet is input to a sample feature data extraction and classification module, the packet is taken as a Key of a five-tuple, a flow ID for marking a flow and corresponding to the flow is generated by hash calculation, the sample feature data extraction and classification module extracts relationship feature data, DPI feature data, DPI signaling feature data and DFI feature data flow by flow and packet by packet; The relationship feature data, the DPI feature data and the DPI signaling feature data are input to a traditional DPI classification and marking system, the traditional DPI classification and marking system classifies and marks the flow according to the above features to obtain traditional DPI identification and classification marking and outputs the traditional DPI identification and classification marking to a classification synthesizer and a DFI feature data filtering and marking module, the DFI feature data filtering and marking module generates training data and real-time data; The training data output by the DFI feature data filtering and marking module is input to a bidirectional deep recurrent neural network for model parameter training; The real-time data output by the DFI feature data filtering and marking module is subjected to network traffic identification and classification through the trained bidirectional deep recurrent neural network to obtain network traffic identification and classification results; The network traffic identification and classification results obtained through the bidirectional deep recurrent neural network are subjected to comprehensive processing with the traditional DPI classification results to obtain final network traffic classification results. The bottom layer of the bidirectional deep recurrent neural network is a bidirectional recurrent neural network taking a bidirectional LSTM as a basic unit, and a unidirectional LSTM is arranged at the upper layer to increase the depth of the bidirectional recurrent neural network.

2. The DFI network traffic classification method based on bidirectional deep recurrent neural network according to claim 1, characterized in that, The bidirectional LSTM splices two hidden states at each time step as an input of the unidirectional LSTM at the upper layer, takes the hidden state at the last time step of the unidirectional LSTM at the upper layer, and finally completes the classification of the network traffic through a Dropout layer and a softmax layer.

3. The DFI network traffic classification method based on bidirectional deep recurrent neural network according to claim 1, characterized in that, The function expression of the LSTM is: wherein: denotes an input gate; denotes a forget gate; denotes an output gate; denotes a memory cell; denotes a candidate memory cell; denotes a hidden state; denotes a sigmoid activation function; denotes a hyperbolic tangent function; denotes an input at a given time step ; , , denote an input under an input gate, a forget gate, an output gate, respectively; denotes a hidden state at a given time step; , , denote an input under an input gate, a forget gate, an output gate of a corresponding ; denotes a weight parameter of an input memory cell; denotes a candidate memory cell hidden state weight parameter; denotes a candidate memory cell at a given time step; denotes an element-wise multiplication operation; , , , denote bias parameters at an input gate, a forget gate, an output gate, a memory cell operation time step, respectively.

4. The DFI network traffic classification method based on bidirectional deep recurrent neural network according to claim 1, characterized in that, The updated hidden state of the bidirectional deep recurrent neural network is: ， wherein, denotes a hidden state; denotes an activation function; denotes a weight parameter of the hidden state; denotes a hidden state at a time instant; denotes an input at a time instant; denotes an input at a time instant ; denotes a hidden state bias parameter; The output of the bidirectional deep recurrent neural network is: ， wherein, denotes an activation function; denotes a hidden state; denotes an output state hidden weight parameter; denotes an output gate operation time bias parameter.

5. The DFI network traffic classification method based on bidirectional deep recurrent neural network according to claim 1, characterized in that, The five-tuple comprises an information source IP, a destination IP, a protocol type, a source port and a destination port.

6. The DFI network traffic classification method based on bidirectional deep recurrent neural network according to claim 1, characterized in that, A 2*12 one-dimensional vector is extracted flow by flow and packet by packet as a feature parameter for the network traffic identification and classification.

7. The DFI network traffic classification method based on bidirectional deep recurrent neural network according to claim 2, characterized in that, The softmax layer adopts a softamx activation function.

Images