Method for establishing network flow classified model and corresponding system thereof

Abstract

The invention provides a setup method of a network flow classification model. The method includes that identification indexes are selected and extracted from the stream data packets of the caught network flow; an initialization cluster center is selected under the set-up cluster numbers according to the identification indexes; a clustering operation is taken on the identification indexes and a new cluster center is newly computed; the normalized mutual information values of all clustering operation results are computed respectively under the set-up cluster numbers and one of the clusters is selected as the best cluster number according to the normalized mutual information values; the clustering operation result under the best cluster number and the new cluster center are selected as the network flow classification model according to the obtained best cluster number. The invention verifies if the selection of the cluster numbers is right by the computation of a NMI value and gives better clustering feature and higher identification precision by the selection of the best cluster number.

Description

technical field [0001] The invention relates to network flow classification, in particular to a method for establishing a classification model in network flow classification and a corresponding system. Background technique [0002] In recent years, with the rapid development of Internet technology, new protocols and application software have emerged, such as P2P (Peer-To-Peer), VOIP (Voice Over Internet Protocol) and so on. The continuous increase of new services keeps the egress network bandwidth utilization rate high and even causes network congestion, especially for enterprise or campus networks. Therefore, network traffic needs to be controlled in practical applications. In addition, applications obtained through unsafe network environments may also cause the intrusion of viruses and malicious codes, bringing hidden dangers to network security. The aforementioned network traffic control and network security both involve how to quickly and accurately identify application...

AI Technical Summary

Problems solved by technology

However, this method also has its own shortcomings: first, it can only identify those applications whose characteristic strings are visible, but it is very difficult to obtain the characteristic strings, especially for some non-public protocols, such as Skype; second, the identification process The process becomes complicated and requires a certain amount of memory, and the Payload of a large number of data packets needs to be saved, which affects the real-time performance of traffic identification

This method has three shortcomings: first, the indicators used are basically flow statistics indicators, which can only be obtained after the end of the flow, so it is not suitable for online real-time recognition; second, it does not explain which indicator can produce better results ;Third, the K-means algorithm used has defects in the selection of the initial cluster center and the determination of the number of clusters, which has a great impact on the results of clustering and the extracted features, and the recognition rate of the experimental results is low

Although the article has made some improvements in the selection of indicators for flow statistics, it does not explain how to improve the shortcomings of the K-means algorithm in the initialization of cluster centers and the determination of the number of clusters.

Images