CN105763479B - A kind of efficient P2P application traffic classification method and system - Google Patents
A kind of efficient P2P application traffic classification method and system Download PDFInfo
- Publication number
- CN105763479B CN105763479B CN201610206196.9A CN201610206196A CN105763479B CN 105763479 B CN105763479 B CN 105763479B CN 201610206196 A CN201610206196 A CN 201610206196A CN 105763479 B CN105763479 B CN 105763479B
- Authority
- CN
- China
- Prior art keywords
- stream
- packet
- application
- window
- data packet
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
- 238000000034 method Methods 0.000 title claims abstract description 33
- 238000004891 communication Methods 0.000 claims abstract description 24
- 239000000284 extract Substances 0.000 claims abstract description 8
- 238000012545 processing Methods 0.000 claims description 9
- 238000000605 extraction Methods 0.000 claims description 8
- 238000010801 machine learning Methods 0.000 description 7
- 238000005516 engineering process Methods 0.000 description 6
- 238000004458 analytical method Methods 0.000 description 5
- 230000006399 behavior Effects 0.000 description 4
- 230000008901 benefit Effects 0.000 description 4
- 238000001514 detection method Methods 0.000 description 4
- 230000008569 process Effects 0.000 description 4
- 238000001914 filtration Methods 0.000 description 3
- 230000000977 initiatory effect Effects 0.000 description 3
- 238000007726 management method Methods 0.000 description 3
- 238000011160 research Methods 0.000 description 3
- 238000012098 association analyses Methods 0.000 description 2
- 230000005540 biological transmission Effects 0.000 description 2
- 238000007405 data analysis Methods 0.000 description 2
- 238000003066 decision tree Methods 0.000 description 2
- 230000006870 function Effects 0.000 description 2
- 230000002452 interceptive effect Effects 0.000 description 2
- 230000007246 mechanism Effects 0.000 description 2
- 239000000203 mixture Substances 0.000 description 2
- 238000012549 training Methods 0.000 description 2
- 238000004364 calculation method Methods 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 238000010276 construction Methods 0.000 description 1
- 238000013500 data storage Methods 0.000 description 1
- 230000001419 dependent effect Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000004146 energy storage Methods 0.000 description 1
- 230000005484 gravity Effects 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 239000003550 marker Substances 0.000 description 1
- 230000006798 recombination Effects 0.000 description 1
- 238000005215 recombination Methods 0.000 description 1
- 230000009467 reduction Effects 0.000 description 1
- 210000003813 thumb Anatomy 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L47/00—Traffic control in data switching networks
- H04L47/10—Flow control; Congestion control
- H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
- H04L47/2441—Traffic characterised by specific attributes, e.g. priority or QoS relying on flow classification, e.g. using integrated services [IntServ]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/10—Protocols in which an application is distributed across nodes in the network
- H04L67/104—Peer-to-peer [P2P] networks
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a kind of efficient P2P application traffic classification method and system.The method include the steps that 1) P2P classified service device obtains quaternary group information, protocol information, packet long message from each data packet of acquisition and is marked and is stored in information structure to the data packet；2) P2P classified service device extracts N number of data packet of every specified stream from information structure, and calculates the basic statistics feature of every stream；3) classify to obtained basic statistics feature, and according to the communication attributes of every stream in obtained result unit of account time window；4) the chi-square statistics amount of the stream is calculated according to the communication attributes of same flow in current window；If it exceeds given threshold, then remove the application class label of the stream；If there is unidentified stream, then unidentified the failing to be sold at auction is denoted as to the P2P application stream in current window with identical IP and port PO RT.The present invention, which classifies, stablizes height, can satisfy most systems online recognition demand.
Description
Technical field
The present invention relates to P2P filed of network information security, be it is a kind of can be applied to P2P network, efficient identification P2P is answered
With the method and system of flow.
Background technique
With being widely used for Internet application, network application has showed many classifications, especially P2P application traffic
Explode, occupy huge network bandwidth, be unfavorable for the service of high quality, while bringing many management to ask to network operator
Topic.P2P is a kind of distributed network, and the participant of network shares a part of hardware resource that they are possessed, and (processing capacity is deposited
Energy storage power, network-connectivity etc.), these resources can directly be accessed by other equity points peer and without intermediate entities.
The P2P complicated network structure, network topology have dynamic, and most flows are encrypted in transmission process, in order to improve
P2P application traffic classification accuracy rate and stability, scientific management planning network, all kinds of P2P application identification technologies are come into being.
(1) sorting technique based on the port P2P.During P2P network communication, either client or server-side,
An either Peer node, it is necessary to IP address and port are provided and another party communicates.This method needs data intercept packet
Head five-tuple, and judge port whether be P2P network application port.Recognition methods advantage based on port is letter
Single, easy to accomplish, classification performance is very high, real-time with higher, it is possible to be applied under high speed network environment.But it is right
For P2P application, the technology of port-hopping is used mostly, and the shortcomings that this method is primarily present is constrained to registered port number
Mesh identification limited amount and being increasing it and can identify that the specific gravity of application is lower and lower with new network application, classify
Accuracy rate is unstable.
(2) the P2P application class technology based on payload.By including specific character string in concrete analysis payload
(signing messages) identifies some negotiation fix informations in payload, such as type of message T, length field to identify application
L, version field Version, all kinds of reserved fields etc. are identified as corresponding P2P application if matching.It is negative based on P2P application
The classification of content is carried due to its accuracy rate with higher, the advantages of classification method is to can be applied to real-time flow point class to know
Other system, and recognition accuracy with higher.The disadvantage is that needing the development and change of follow-up P2P application in time, the spy of new opplication
Sign extracts larger workload, and many P2P flows are proprietary protocol and encryption flow, for example a sudden peal of thunder just uses privately owned association
View is difficult to excavate its load characteristic to transmit data.So still can not effectively identify that P2P is applied using this method, it can not
Ensure the validity and real-time of some features.
(3) the P2P application class technology based on network behavior.By the network behavior feature of interaction both sides, P2P net is extracted
The communication feature of network application includes mainly Flow continuity, using multi connectivity, agreement confusion, and port discreteness and defeated
Enter the P2P application communication feature such as output flow harmony, the P2P application for classifying different.This method advantage is not have to consider port
Number, and do not have to carry out deep analysis to data packet, effectively increase classification performance.It is answered the disadvantage is that classification P2P cannot be refined
With can only effectively judge P2P class flow, also because P2P applies in interactive process routing to have dynamic, cause this method
Stability of classifying is not high, has its limitation, therefore Detection accuracy is also different because of system.
(4) the P2P application class technology based on machine learning.Research hotspot is mainly in the classification based on machine learning at present
Method, different application network flow have certain stream feature, go out stream feature extraction to be used together machine learning algorithm to train
Disaggregated model is established, is then classified to application on site flow.Machine learning algorithm based on statistical theory is due to it
Background and mature theoretical frame is widely applied more and more to be used in stream sort research.Although P2P application class
Statistical learning method there is mature theoretical model, but the method for machine learning compares dependence data set, heterogeneous networks ring
Border may will affect classification accuracy, and when calculating some stream features, need to calculate the feature of each packet in stream,
In the case of network flow rises suddenly and sharply, declined using the performance of identification, classification accuracy is unstable.
Summary of the invention
Above-mentioned existing method there are aiming at the problem that, the multithread association that the invention discloses a kind of based on sliding time window
P2P application class method and system.
The invention discloses a kind of, and the multithread based on sliding time window is associated with P2P application class method, specific steps packet
It includes:
(1) initiation parameter: the structural body flowAttr of P2P traffic statistics essential characteristic is initialized as 0, four P2P streams
Measure communication behavior: port discreteness f1, it is initialized as 0；I/O traffic is than feature f2, it is initialized as 1；Big window continuity
f3, it is initialized as 0；Wicket transience f4, it is initialized as 0；Polynary misrecognition stream statistics chi-squared variable χ2, it is initialized as 1.s_
AttrRule, initialization 0, card side traverse parameter, and (threshold value can be set in initial phase, can also be according to demand for initialization 0.6
Configuration updates threshold value)；
(2) received data packet and conversate recombination and parsing: the capture of data packet is carried out in specified network interface card.It will be current
The information such as four-tuple, agreement, the packet length of the data packet of capture are marked, and are stored in information structure flowAttr, after
Continuous step will carry out detailed data analysis according to relevant information of the mark information to current data packet；
(3) basic statistics feature calculation: the read data packet from specified structure body flowAttr is flowed, every is filtered out and specifies
(N < 10, N of the present invention are that 9) data packet calculates the basic system of every stream to packet data progress detailed analysis to the top n of stream
Feature flowAttr is counted, TCP and udp protocol count different feature here, and the feature of calculating includes:
1) the TCP statistical nature in P2P flow:
It is long to most parcel before min_fpktl；To home window before win_fbytes；To home window after win_bbytes；
It is grown before first_fpktl to first packet；To minimum packet length after min_bpktl；It wraps and grows to third before third_fpktl；
Max_fpktl maximum forward packet length；It is grown after mean_bpktl to average packet；To psh packet number before fpsh_cnt；Duration stream
Duration.
2) the UDP statistical nature in P2P flow:
To maximum packet length before max_fpktl；To maximum packet length after max_bpktl；To packet after mean_bpktl is average
Length；It is grown before first_fpktl to first packet；It is grown after sec_bpktl to second packet；To third after third_bpktl
Packet length；To packet length before mean_fpktl is average；Two-way first packet length of first_diff is poor；To minimum after min_bpktl
Packet length；Duration flows the duration.
(4) preliminary classification is carried out using characteristic of division stream
According to off-line arrangement, good characteristic of division numerical value carries out detection judgement to network data flow, first determines whether current network
Data flow is Transmission Control Protocol or udp protocol, then for TCP or UDP respectively using different rules to the basic system flowed online
Meter feature progress is tentatively rapidly classified, and the agreement of classification results and every stream that every P2P application is flowed, five-tuple are believed
Breath, packet number, flow are recorded in log using coding.
(5) classification of P2P application traffic
In each chronomere's window, quantify four respectively as a result, being calculated using step (4) data classification
P2P communication attributes.
1) calculate the port discreteness of every each port of stream: port discreteness records each stream client port
ClientPort value, for the weight for balancing each attribute, uses hash function since P2P application communication port is generally bigger
It will be in the section client port hash to 0 to 1.
f1=Hash (ClientPort)
2) calculate the I/O traffic ratio of every stream: input/output flow-rate ratio uses the input byte number of every stream
Fbytes quantifies divided by output word joint number bbytes；
3) calculate the continuity of every stream big window: big window connection attribute is greater than just using packet payload length in every stream
The quantity big_wins of the packet of beginningization length of window and whole stream packet number flow_packets quantifies；
4) calculate the transience of every stream wicket: the of short duration attribute of wicket is less than using packet load in every stream flows first three
It is a to wrap long quantity small_wins and whole stream packet number flow_packets to quantify；
5) chi-squared variable under continuous multiple time window units is counted, the P2P stream of misrecognition is detected；
EWiIt is the mean value for being marked as i-th of P2P communication attributes of same application before current window in N-1 window, N setting
It is 4.In identification process, time window can be slided backward constantly.If the χ in some time window2Statistic is greater than threshold value
0.6, then the stream of IF-ELSE classification marker is considered as misrecognition and the application class of the stream is marked into removal.In a time list
Use multithread space time correlation in the window of position, the time refers on a time window, space refer in the window in every stream IP and
Port PO RT.If using the same IP and port PO RT in IF-ELSE rule classification label result on a time window
Stream have unidentified stream, then this is failed to be sold at auction and is denoted as the identified stream of corresponding IP and PORT.
(6) to memory space zero setting or initiation parameter needed for detection feature, step (2) are gone to.
The present invention also discloses a kind of multithread association P2P application class system based on sliding time window simultaneously, mainly
By packet capture, data processing and extraction characteristic module, rule classification module and association identify 4 modules compositions.System fortune
It is capable that specific step is as follows:
(1) system initialization: configuration management parses user profile, is loaded into and is the configuration of P2P applies classification rules
System storage, configuration include that specified network card data monitors configuration, the configuration of data filtering rule, the configuration of data storage rule etc.；Configuration
After loading successfully, system is monitored and waits data to be received；
(2) packet capture module: acquisition data packet will to certain filtering that the data packet of non-interesting flow carries out
Data packet is stored into structural body, goes to step (3)；
(3) data processing and extraction characteristic module: a data packet is received, detailed analysis is carried out to packet data, is pressed
The message is handled according to following steps:
(3.1) flow is cleared up: the purpose of this technology, is needed before carrying out statistical flow characteristic extraction for P2P traffic classification
Flow is effectively cleared up, mainly removal ad traffic, removes DNS flow, and divide the flow into TCP and UDP
Flow；
(3.2) it extracts the basic statistics feature of every TCP flow: calculating the statistical flow characteristic of TCP, including preceding to most parcel
First length, forward direction home window, backward home window, forward direction packet be long, backward minimum packet length, forward direction third packet length, most
Big forward direction packet length, backward average packet length, forward direction psh packet number, stream duration；
(3.3) extract the basic statistics feature of every UDP flow: forward direction maximum packet length, backward maximum packet length, it is average after
To packet length, first packet length of forward direction, backward second packet is long, backward third packet is long, average preceding to packet length, two-way first
A packet length is poor, backward minimum packet length, stream duration.
(4) rule classification module: by offline machine learning, using configured decision tree training rules, according to step
(3) statistical flow characteristic calculated carries out P2P traffic classification；
(5) association analysis identification module: in the result that step (4) carry out a P2P traffic classification, online point meter in real time
Four P2P attribute values of each time window are calculated, time window is set as 5 minutes, handles a subseries in accordance with the following steps
As a result:
(5.1) the P2P communication attributes of every stream for being identified as the same P2P application under a time window are calculated, point
It is not the transience of port discreteness, I/O traffic harmony, big window continuity and wicket.Port discreteness makes
The client port of every stream is handled with hash function, input/output flow-rate ratio is using the input byte number of every stream divided by defeated
Byte number out, big window connection attribute are greater than the big parcel quantity of initial window using packet load in every stream and wrap divided by whole stream
Number, the of short duration attribute of wicket is less than using packet load in every stream flows the long quantity of first three packet divided by whole stream packet number；
(5.2) the chi-square statistics amount χ under sliding time window is calculated2: the P2P communication attributes calculated according to (5.1),
Calculate the chi-square statistics amount under continuous four time windows:
If chi-square statistics amount is greater than the threshold value of setting, the flow label in a rule classification is removed；
(5.3) it uses the P2P application traffic of space time correlation online recognition: using multithread space-time in chronomere's window
Association, time window is set as 5 minutes, and space uses IP and port PO RT in every stream in the window.If in a time
On window, the stream of the same IP and port PO RT have unidentified stream, then this is failed to be sold at auction is denoted as corresponding IP and PORT is identified
Stream.
(6) continue step (2).
Compared with published method, the present invention has the advantage that
1) P2P application recognition accuracy and recall rate are higher than previous classification method, and classification is stablized, and can satisfy most of
The demand of system online recognition；
2) can Configuration Online P2P application identification rule, can more accurately reflect the feature of current P2P application communication,
The retractility of identifying system；
3) this method and system can provide P2P application recognition credibility, interactive process parameter command etc. and retouch in more detail
It states, key message can be timely feedbacked to application system；
4) multi-parameter statistics identification is introduced, statistical parameter had both been covered based on P2P Port detecting, based on P2P load contents
Detection method is also analyzed P2P application interbehavior feature using the method for machine learning and is known by multithread relevant parameter
Other P2P improves the accuracy rate of system while guaranteeing system effectiveness to greatest extent；
5) the weight flexible allocation for passing through multiple portions, fast and effeciently selects P2P communication flows statistical nature, reduces machine
Data set attribute dimension used in device learning training improves classification performance；
6) P2P application traffic statistical nature, which extracts, need to only consider to flow top n data packet (N < 10), and previous research is general
It is to consider to extract statistical flow characteristic from whole stream, the number of data packets of every stream beginning is calculated by reducing, is effectively increased point
Class performance；
7) recognition mechanism has diversity, flexibility, and using sliding time window mechanism, the P2P for being adapted to variation is answered
Use environment-identification.
Detailed description of the invention
Fig. 1 is the flow chart that the multithread based on sliding time window is associated with P2P application class；
Fig. 2 is that the multithread based on sliding time window is associated with P2P application class system structure module map；
Fig. 3 is system deployment connection figure；
(a) deployment way 1, the router connection between P2P classified service device and intranet and extranet,
(b) deployment way 2, the interchanger connection between P2P classified service device and intranet and extranet,
(c) deployment way 3, P2P classified service device are connect with interior network router,
(d) deployment way 4, P2P classified service device are connect with Intra-Network switch.
Specific embodiment
In the following, the present invention is described in detail in conjunction with specific embodiments.
Fig. 1 gives the process provided by the invention to P2P application traffic classification method, and specific implementation step is as follows:
(1) initiation parameter: the structural body flowAttr of P2P traffic statistics essential characteristic is initialized as 0, four P2P streams
Measure communication behavior port discreteness f1, it is initialized as 0；I/O traffic is than feature f2, it is initialized as 1；Big window continuity
f3, it is initialized as 0；Wicket transience f4, it is initialized as 0；Polynary misrecognition stream statistics chi-squared variable χ2, it is initialized as 1.P2P
The configuration parameter of applies classification rules, (threshold value can be set dependent thresholds in initial phase, lower according to demand can also be configured more
New threshold value)；
(2) it received data packet and is parsed: configuring certain parameter, carry out the capture of data packet in specified network interface card.
Protocol assembly obtains a network packet, carries out ICP/IP protocol reduction to the data packet, obtains packet networks layer stem
With transport layer header message, such as source IP, destination IP, source port, destination port, agreement, packet are long, TCP flag information etc..Afterwards
Continuous module will carry out detailed data analysis according to relevant information of the mark information to current data packet；
(3) data processing and feature extraction: the read data packet from specified structure body carries out the data packet of specified protocol
Filtering, read data packet and the Hash table progress with corresponding four-tuple mark from the structural body of step (2) storing data packet
Comparison, the data packet for extracting same stream carry out detailed analysis, calculate the statistical nature of every stream:
1) it filters DNS flow: the stream of 53 ports being filtered out, is judged if it is DNS message then according to DNS message format
It is marked according to P2P server domain name and applies and jump to step (2) accordingly, then entered in next step if not DNS message；
2) it calculates TCP flow statistical nature: extracting the basic statistics feature of 9 data packets before every TCP flow: calculating TCP's
Statistical flow characteristic, including it is preceding long, backward minimum to first most parcel length, forward direction home window, backward home window, forward direction packet
Packet length, forward direction third packet length, maximum forward packet length, backward average packet length, forward direction psh packet number, stream duration；
3) it calculates UDP flow statistical nature: extracting the basic statistics feature of 9 data packets before every UDP flow: forward direction maximum packet
Length, backward maximum packet length wrap after being averaged to packet length, first packet length of forward direction, backward second packet length, backward third
Before long, average to packet length, two-way first packet length be poor, backward minimum packet length, stream duration；
(4) using the IF-ELSE rule classification of configuration: using step (3) every statistical flow characteristic extract as a result, with from
The Decision Tree Rule of line study is compared one by one, and each condition meets, and is marked as corresponding P2P application, is otherwise labeled as
Sky, any rule of foot with thumb down；
(5) the multithread association analysis of sliding time window: for being classified as same P2P application in a time window
Stream calculates the P2P attribute of every stream, is port discreteness, I/O traffic harmonious, big window continuity and small respectively
The transience of window calculates chi-square statistics amount, removes the flow label of wrong report, then uses space time correlation by unidentified flow label
At identified stream；
(6) memory space zero setting or initialization needed for flowing related statistical nature to above-mentioned every, restart to unite
Meter, goes to step (2).
The present invention also provides a kind of multithread association P2P application class system based on sliding time window simultaneously, mainly
By packet capture, data processing and extraction characteristic module, rule classification module and association identify 4 modules compositions.Its system
Construction module is as shown in Figure 2.Categorizing system can be deployed in enterprise gateway entrance, operator's couple in router or backbone router
Etc. various environment, the mirror image data of processing gateway or router, deployment connection is as shown in Figure 3.
Claims (6)
1. a kind of efficient P2P application traffic classification method, the steps include:
1) P2P classified service device obtains quaternary group information, protocol information, packet long message and to this from each data packet of acquisition
Data packet is marked, and then the data packet of label is stored in information structure；
2) P2P classified service device extracts N number of data packet of every specified stream from information structure, and calculates every P2P application
The basic statistics feature of stream；Wherein, the basic statistics feature of every P2P application stream include TCP statistical nature in P2P flow and
UDP statistical nature in P2P flow；
3) classified according to the good characteristic of division numerical value of off-line arrangement to the basic statistics feature that step 2) obtains；
4) communication attributes that every P2P application is flowed in the result unit of account time window obtained according to step 3)；
5) the chi-square statistics amount χ of P2P application stream is calculated according to the communication attributes of P2P same in current window application stream2；If
Chi-square statistics amount χ2More than given threshold, then the application class label of P2P application stream is removed；If there is unidentified P2P
Using stream, then the unidentified P2P application failing to be sold at auction to be denoted as in current window, there is the P2P of identical IP and port PO RT to apply
Stream；
Wherein, the communication attributes include port discreteness f1, I/O traffic ratio f2, big window continuity f3, wicket it is short
Temporary property f4；Port discreteness f1=Hash (ClientPort), ClientPort are client port value；I/O traffic ratioFbytes is input byte number, bbytes is output word joint number；Big window continuityBig_wins is the quantity for the packet that packet payload length is greater than initial window length, flow_
Packets is the packet number of whole stream；Wicket transienceSmall_wins is that packet payload length is small
In the packet number for flowing first three packet length.
2. the method as described in claim 1, which is characterized in that chi-square statistics amountWherein, EWiIt is to work as
The mean value of i-th of communication attributes of same P2P application stream is marked as before front window in N-1 window, n is communication attributes sum.
3. the method as described in claim 1, which is characterized in that in the step 3), P2P classified service device answers every P2P
With the classification results of stream, five-tuple information, packet number, flow, using encoded information day is recorded in the agreement of every P2P application stream
In will.
4. the method as described in claim 1, which is characterized in that N number of data packet is the continuous top n data packet of every stream.
5. a kind of efficient P2P application traffic classification system, which is characterized in that including packet capture module, data processing and
Extract characteristic module, rule classification module and association identification module；Wherein,
Packet capture module is grown for acquiring data packet and obtaining quaternary group information, protocol information, packet from each data packet
Information is simultaneously marked the data packet, and then the data packet of label is stored in information structure；
Data processing and extraction characteristic module, for extracting N number of data packet of every specified stream from information structure, and calculate
The basic statistics feature of every P2P application stream；Wherein the basic statistics feature of every P2P application stream includes the TCP in P2P flow
UDP statistical nature in statistical nature and P2P flow；
Rule classification module, for being obtained according to the good characteristic of division numerical value of off-line arrangement to data processing and extraction characteristic module
Basic statistics feature classify；
It is associated with identification module, every P2P application in the result unit of account time window for obtaining according to rule classification module
The communication attributes of stream；And it is united according to the card side that the communication attributes of P2P same in current window application stream calculate P2P application stream
Measure χ2；If chi-square statistics amount χ2More than given threshold, then the application class label of P2P application stream is removed；If there is not
The unidentified P2P application is then failed to be sold at auction and is denoted as in current window with identical IP and port PO RT by the P2P application stream of identification
P2P application stream；
Wherein, the communication attributes include port discreteness f1, I/O traffic ratio f2, big window continuity f3, wicket it is short
Temporary property f4；Port discreteness f1=Hash (ClientPort), ClientPort are client port value；I/O traffic ratioFbytes is input byte number, bbytes is output word joint number；Big window continuityBig_wins is the quantity for the packet that packet payload length is greater than initial window length, flow_
Packets is the packet number of whole stream；Wicket transienceSmall_wins is that packet payload length is small
In the packet number for flowing first three packet length.
6. system as claimed in claim 5, which is characterized in that chi-square statistics amountWherein, EWiIt is to work as
The mean value of i-th of communication attributes of same P2P application stream is marked as before front window in N-1 window, n is communication attributes sum.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610206196.9A CN105763479B (en) | 2016-04-05 | 2016-04-05 | A kind of efficient P2P application traffic classification method and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610206196.9A CN105763479B (en) | 2016-04-05 | 2016-04-05 | A kind of efficient P2P application traffic classification method and system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN105763479A CN105763479A (en) | 2016-07-13 |
| CN105763479B true CN105763479B (en) | 2019-04-30 |
Family
ID=56347230
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610206196.9A Expired - Fee Related CN105763479B (en) | 2016-04-05 | 2016-04-05 | A kind of efficient P2P application traffic classification method and system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN105763479B (en) |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101741608A (en) * | 2008-11-10 | 2010-06-16 | 北京启明星辰信息技术股份有限公司 | Traffic characteristic-based P2P application identification system and method |
| CN104657747A (en) * | 2015-01-30 | 2015-05-27 | 南京邮电大学 | Online game stream classifying method based on statistical characteristics |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101814977B (en) * | 2010-04-22 | 2012-11-21 | 北京邮电大学 | TCP flow on-line identification method and device utilizing head feature of data stream |
-
2016
- 2016-04-05 CN CN201610206196.9A patent/CN105763479B/en not_active Expired - Fee Related
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101741608A (en) * | 2008-11-10 | 2010-06-16 | 北京启明星辰信息技术股份有限公司 | Traffic characteristic-based P2P application identification system and method |
| CN104657747A (en) * | 2015-01-30 | 2015-05-27 | 南京邮电大学 | Online game stream classifying method based on statistical characteristics |
Non-Patent Citations (1)
| Title |
|---|
| 《基于统计特性的P2P流量识别方法研究》;李晓歌等;《内江科技》;20070531;全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN105763479A (en) | 2016-07-13 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN102271090B (en) | Transport-layer-characteristic-based traffic classification method and device | |
| CN105871832B (en) | A kind of network application encryption method for recognizing flux and its device based on protocol attribute | |
| CN102315974B (en) | Stratification characteristic analysis-based method and apparatus thereof for on-line identification for TCP, UDP flows | |
| CN101257454B (en) | Apparatus and method for managing band width | |
| US7644150B1 (en) | System and method for network traffic management | |
| CN104320304B (en) | A kind of core network user flow application recognition methods of the multimode fusion easily extended | |
| CN102523241B (en) | Method and device for classifying network traffic on line based on decision tree high-speed parallel processing | |
| CN100553206C (en) | Internet, applications method for recognizing flux based on packet sampling and application signature | |
| CN102739457B (en) | Network flow recognition system and method based on DPI (Deep Packet Inspection) and SVM (Support Vector Machine) technology | |
| CN104320358A (en) | QoS (Quality of Service) business control method in power telecommunication net | |
| CN108881028B (en) | SDN network resource scheduling method for realizing application awareness based on deep learning | |
| Park et al. | Fine‐grained traffic classification based on functional separation | |
| CN103139315A (en) | Application layer protocol analysis method suitable for home gateway | |
| CN101714952A (en) | Method and device for identifying traffic of access network | |
| CN112949739A (en) | Information transmission scheduling method and system based on intelligent traffic classification | |
| CN102571946A (en) | Realization method of protocol identification and control system based on P2P (peer-to-peer network) | |
| Lu et al. | A heuristic-based co-clustering algorithm for the internet traffic classification | |
| CN108667804B (en) | DDoS attack detection and protection method and system based on SDN architecture | |
| CN113382039A (en) | Application identification method and system based on 5G mobile network flow analysis | |
| CN105763479B (en) | A kind of efficient P2P application traffic classification method and system | |
| CN101764754A (en) | Sample acquiring method in business identifying system based on DPI and DFI | |
| Tavallaee et al. | Online classification of network flows | |
| Ertam et al. | Classification with intelligent systems for internet traffic in enterprise networks | |
| Holanda Filho et al. | An internet traffic classification methodology based on statistical discriminators | |
| Chen et al. | IPzip: A stream-aware IP compression algorithm |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20190430 |
|
| CF01 | Termination of patent right due to non-payment of annual fee |