An online traffic identification method based on incremental clustering algorithm

Abstract

The invention belongs to the network technical field, in particular to an online traffic identification method based on an incremental clustering algorithm. The method includes: an offline recognitionstage and an online recognition stage, wherein in the offline recognition stage,a semi-supervised learning flow algorithm based on an improved K-means algorithm is used to perform preliminary clustering and mapping work on the prepared training data sets, and the data sets which are preliminarily classifiedare obtained; in the online recognition stage,based on the completed clustering and mappingdata sets formed in the offline identification phase, incremental clustering is used to determine the network application type of the newly added data streams online, so as to achieve the purpose oftraffic identification. According to the method,based on machine learning technology, by constructing a suitable recognition model to learn the prepared data, the online traffic can be incrementally clustered in real time, and the preliminary semi-supervised classification can be carried out by combining the prepared training set, which can realize the online recognition of network traffic, and has good real-time performance and high recognition rate.

Description

technical field [0001] The invention belongs to the field of network technology, and in particular relates to an online traffic identification method based on an incremental clustering algorithm. Background technique [0002] With the rapid development of the Internet, the network environment has become more and more complex, and new types of applications and services have become increasingly diverse. Real-time and accurate identification of network traffic is of great significance to network management and traffic. There are currently four traffic identification methods: port number-based traffic identification methods, behavioral feature-based traffic identification methods, deep packet inspection-based traffic identification methods, and machine learning-based traffic identification methods. The identification method based on the port number is only accurate for network protocol traffic identification using commonly used ports and registered ports; the identification meth...

AI Technical Summary

Problems solved by technology

The identification method based on the port number is only accurate for network protocol traffic identification using commonly used ports and registered ports; the identification method based on behavioral feature matching has relatively large time and space overhead, and the identification performance is insufficient; the traffic identification method based on deep packet inspection It takes a lot of manpower and material resources to establish a rule base, and there are also deficiencies in the identification of encrypted traffic; some common machine learning-based methods need to extract the statistical characteristics of the complete flow in an offline environment. However, due to the real-time , changeable, perishable and irreversible, this type of traffic identification method cannot meet the needs of online real-time traffic identification

Images