Application Identification Models for Port-Independent Traffic Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current port detection technologies can identify protocol types based on pre-registered mapping relationships but fail to determine the corresponding application software, failing to meet market requirements for precise traffic identification.
Innovation Solution
A method and apparatus for generating an application identification model by extracting target parameters from data packets, training an initial identification model, and adjusting it based on sample quantities and accuracy criteria to accurately identify applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If port detection technology is used to identify protocol types based on pre-registered mapping relationships, then protocol type identification is achieved, but application software identification capability is lost
Solution Approach 1:
The patent transforms the identification approach by changing from static port number mapping to dynamic multi-parameter analysis. It extracts multiple features including packet length, inter-arrival time, payload content, and protocol characteristics, then uses machine learning models to analyze these parameters collectively for application identification, resolving the limitation of port-based detection.
Solution Approach 2:
The patent introduces machine learning models as intermediaries between raw packet data and application identification. These models process extracted features and transform them into application identifiers, enabling the system to bridge the gap between protocol detection and application recognition without directly relying on port number mappings.
2Measurement precision
If machine learning models are trained with sufficient samples for each application, then identification accuracy is improved, but data collection and processing complexity increases
Solution Approach 1:
The patent performs preliminary actions by pre-collecting and storing samples during off-peak periods, and by pre-training models with comprehensive datasets before deployment. This allows the system to have sufficient training data ready in advance, reducing the complexity of real-time data collection and processing while maintaining high identification accuracy.
Solution Approach 2:
The patent segments the sample collection and processing into distinct phases: data collection phase, feature extraction phase, model training phase, and deployment phase. This segmentation allows each phase to be optimized independently, reducing overall complexity while ensuring sufficient samples are obtained for accurate model training.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Embodiments of this application disclose a method and an apparatus for generating an application identification model. The method includes: obtaining Y data packets, where the Y data packets correspond to P applications, an ith application in the P applications corresponds to M(i) data packets, and Y=∑i=1PMi, 1≤ i ≤ P; extracting a target parameter of each of the M(i) data packets of each of the P applications to obtain M(i) samples, where the target parameter indicates information about a session connection established between the ith application and a server that provides the ith application; and training an initial identification model based on the M(i) samples of each of the P applications, to obtain a first application identification model, where the first application identification model is used to determine, based on a target parameter of a data packet, an application corresponding to the data packet. In the embodiments of this application, an application corresponding to an unknown data packet may be determined by using the generated first application identification model, to accurately identify data traffic.