Network traffic classification method and device based on active learning

Abstract

The invention discloses a network traffic classification method and device based on active learning, and the method comprises the steps: an offline training process: carrying out the multi-round active learning and performance evaluation on a network traffic classification model obtained through initialization training on a network traffic data set accumulated in history till a preset evaluation requirement is met, outputting the network traffic classification model meeting a preset evaluation requirement, and ending an offline training process; and an online prediction process: carrying out online prediction on the real-time network traffic data by utilizing the network traffic classification model obtained in the offline training process, and meanwhile, carrying out online active learning on the network traffic classification model. According to the network traffic classification method based on active learning, good classification performance of the network traffic classification model can be guaranteed while manpower and material resource expenses are reduced, and the network traffic classification model obtained based on active learning training is especially suitable for classification prediction of unbalanced network traffic data.

Description

technical field [0001] The invention belongs to the field of network flow management, and in particular relates to an active learning-based network flow classification method and device. Background technique [0002] With the rapid development of the Internet industry and the rapid development of application innovation, the diversity, evolution and complexity of network traffic types are increasing with the continuous emergence of new network applications and network protocols. At the same time, network operation service providers and network supervision departments There are also more and more demands for understanding the composition of network traffic, implementing differentiated network services, and purifying the network environment. Therefore, how to accurately classify the continuous unknown network traffic and support the rapid redistribution of network resources, thereby improving the utilization of network resources and customer satisfaction with personalized servi...

AI Technical Summary

Problems solved by technology

On the one hand, these traditional methods require a large number of training samples with real labels to train the classifier, but obtaining a large number of real labels requires a lot of manpower and material resources, and once the type evolution occurs, the performance of the originally trained classifier will often decrease sharply.

On the other hand, with the continuous emergence of new network applications and new types of traffic, the proportion of various types of traffic is always evolving dynamically. However, traditional methods tend to be biased towards large categories of data in unbalanced traffic, and it is easy to ignore the importance of new network applications. The small class of traffic data generated in the early stage is more difficult to identify the malicious traffic data that is disguised and fickle. Although this kind of malicious traffic data accounts for a small proportion but has great harm, it is the key target of network supervision

Images