Dynamic self-updating network traffic classification method based on topic model

Abstract

The invention discloses a dynamic self-updating network traffic classification method based on a topic model which comprises the following steps of: at an initial moment, initializing a classificationmodel by using a data packet set marked with a protocol category in advance as an initialization data set so as to obtain a classification model at a moment 1; classifying the data packets: classifying the to-be-classified data packets received at the moment t by utilizing a classification model, and outputting protocol types and protocol distribution information of the to-be-classified data packets at the moment t; training and updating the classification model: forming a training set by using the data packet of the known protocol types output at the moment t, and by using the historical protocol distribution information outputted by L, t-1, ..., t-(L-1) as the subject prior distribution, training the classification model at the moment t+1; t=1, 2, 3,. . . , L=1, 2,. . . ,Delta. The method solves the problems of low efficiency, influence on the accuracy of the classification model due to no consideration of unknown type of traffic, reduction of the classification accuracy due to insufficient consideration of network traffic dynamics and the like.

Description

technical field [0001] The invention relates to the technical field of computer networks, in particular to the fields of traffic detection and network security, in particular to a dynamic self-updating network traffic classification method based on topic models. Background technique [0002] Network protocol refers to the communication specification for communication between different computers, including process control, services provided, and data format. Open System Interconnection Reference Model (OpenSystem Interconnection Reference Model) is a network interconnection model proposed by the International Organization for Standardization in 1978. The model is divided into seven layers, and each layer defines the service provision and protocol specifications of the layer. The identification of application layer protocols can help network providers, network security management agencies, etc. to provide better network services and detect malicious traffic. [0003] Network ...

AI Technical Summary

Problems solved by technology

[0009] The main purpose of the present invention is to propose a dynamic self-updating network traffic classification method based on the topic model in order to address the shortcomings of the existing network traffic classification methods. Through the dynamic clustering topic model, the network traffic of learning and memory nodes changes with time It can automatically adjust and update the classification model, and can also directly perform multi-classification, and directly map data packets to the classification protocol, so as to solve the problem of low efficiency in the existing technology and the impact on the classification model without considering unknown types of traffic. Accuracy, failure to fully consider network traffic dynamics and reduce classification accuracy, etc.

Images