Content sensing method based on network stream behaviors

Abstract

The invention provides a content sensing method based on network stream behaviors. The content sensing method comprises the following steps: acquiring network flow in an outer network environment andextracting an observational characteristic as a training sample; training a model by utilizing the training sample; inputting a network stream with an unknown type into the model and identifying the content; carrying out incremental learning by utilizing recognized network stream flow and historical model parameters; updating the model parameters to ensure the continuity of model classes. According to the content sensing method provided by the invention, a dynamic modeling capability of a hidden Markovmoder model and a powerful nonlinear expression capability of a deep neural network are utilized; an experiment result shows the feasibility of the method and compares performance advantages of an existing technical scheme.

Description

technical field [0001] The invention belongs to the field of network technology, and more specifically relates to a content perception method based on network flow behavior. Background technique [0002] Classification and identification of network traffic is fundamental to many network management problems. By accurately identifying the type of network traffic, network administrators can provide different types of network applications / services with different quality of service according to a given strategy; Infrastructure planning provides a basis; in addition, traffic classification is also a key part of the intrusion detection system, which prevents attacks by identifying abnormal network traffic, and is an important detection method in the field of network security. [0003] There are four commonly used traffic classification methods: 1) method based on port, 2) method based on packet load characteristics, 3) method based on flow, and 4) method based on mixed characteris...

AI Technical Summary

Problems solved by technology

The DPI method also has its defects and deficiencies: First, as people's awareness of network security increases, more and more applications use encrypted protocols to transmit data (see the paper "Velan P, M, P, et al.A survey of methods for encrypted traffic classification and analysis[J].International Journal of Network Management,2015,25(5):355-374."), DPI is difficult to handle encrypted traffic; secondly, user data Packet analysis involves privacy protection issues; third, it is impossible to obtain the characteristic structure description of private protocols

Just identifying the protocol or application corresponding to the traffic is not enough to implement effective supervision on the network flow

Images