CN113965524A - Network flow classification method and flow control system based on same - Google Patents

Network flow classification method and flow control system based on same Download PDF

Info

Publication number
CN113965524A
CN113965524A CN202111149697.5A CN202111149697A CN113965524A CN 113965524 A CN113965524 A CN 113965524A CN 202111149697 A CN202111149697 A CN 202111149697A CN 113965524 A CN113965524 A CN 113965524A
Authority
CN
China
Prior art keywords
data set
network traffic
flow
network
traffic
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202111149697.5A
Other languages
Chinese (zh)
Inventor
谭国平
朱林林
周思源
马飞
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Hohai University HHU
Original Assignee
Hohai University HHU
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Hohai University HHU filed Critical Hohai University HHU
Priority to CN202111149697.5A priority Critical patent/CN113965524A/en
Publication of CN113965524A publication Critical patent/CN113965524A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
    • H04L47/2441—Traffic characterised by specific attributes, e.g. priority or QoS relying on flow classification, e.g. using integrated services [IntServ]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/24—Classification techniques
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N20/00—Machine learning

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Artificial Intelligence (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • General Physics & Mathematics (AREA)
  • Evolutionary Computation (AREA)
  • Physics & Mathematics (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Evolutionary Biology (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Medical Informatics (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Computing Systems (AREA)
  • Mathematical Physics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

The invention discloses a network traffic classification method, which comprises the following steps: the method comprises the steps of reducing dimensions of an initial data set by using a feature selection algorithm based on an information theory, giving a threshold value of feature measurement, selecting a feature subset which can more measure unbalanced network flow from a high-dimensional data set, and further optimizing a classification algorithm by using an optimal candidate subset search algorithm with low complexity; the invention also discloses a flow control system based on the method, and the control system comprises: the method is characterized in that the flow control function is realized by adopting an SDN network architecture, a network flow classification module is embedded in an application plane, and the module is developed by utilizing an Ryu controller, so that the information such as network flow collection, machine learning classification, service types of different network flow categories and the like are output according to classification results.

Description

Network flow classification method and flow control system based on same
Technical Field
The invention relates to the technical field of network security, in particular to a network flow classification method and a flow control system based on the method.
Background
The network traffic classification is an important part of network management, QOS and network security, and in recent years, the importance of the network traffic classification is increasingly prominent with the increase of the scale of netizens and the popularity of the internet. The development of network traffic classification technology is changed from a port-based method to deep packet inspection-based method, and until 249 statistical characteristics of network traffic are described by a human system, the network traffic classification method based on machine learning is not deeply researched. However, due to the reasons that the collection of network traffic cannot be controlled, the network technology develops, that is, the amount of some kinds of network traffic increases rapidly, and the like, the network traffic increasingly presents a situation that the distribution of samples of each category is unbalanced. Data preprocessing, classification algorithm selection and model evaluation are indispensable processes in the field of machine learning, and whether a classification task is efficient or not is determined. Each process in the conventional machine learning method is designed to improve the overall accuracy or classification speed of the classification model, so as to ignore the classification accuracy of different classes of network traffic in the network traffic, and these few classes of network traffic, such as attach class traffic, are traffic classes that must be considered important in the network security field.
The network traffic classification technology based on machine learning can be deployed in a programmable and easily-extensible SDN network architecture, different controls are provided for classified traffic by utilizing strong network management and control capacity of an SDN, and different network resources are provided for different types of services.
Disclosure of Invention
The invention provides a network flow classification method and a flow control system based on the method, aiming at overcoming the defects of the prior art, and adopting a characteristic selection algorithm based on an information theory to reduce the dimension of an initial data set, giving a threshold value of characteristic measurement, and selecting a characteristic subset which can more measure unbalanced network flow from a high-dimensional data set; then selecting a proper classification algorithm to perform modeling learning and model evaluation on the data set subjected to the data preprocessing; embedding a network flow classification module in an application plane of a virtual SDN framework, developing the module by utilizing an Ryu controller, realizing network flow collection and machine learning classification, and executing different operations on different network flows according to classification results.
The invention adopts the following technical scheme for solving the technical problems:
the invention provides a network traffic classification method, which comprises the following steps:
step one, obtaining an initial flow data set S (F, C), wherein F is F ═ F1,f2,…fN}，C＝{C1,C2,…CMS (F, C) includes N network traffic statistical features F and M network traffic classes C, FiAs the ith network traffic statistic, CjThe j-th network flow category is N is more than or equal to i and more than or equal to 1, and M is more than or equal to j and more than or equal to 1;
cleaning the initial flow data set, selecting the correlation of the characteristics of the cleaned initial flow data set by adopting a characteristic selection algorithm, storing the selected characteristics to an optimal characteristic flow data set, and outputting the optimal characteristic flow data set;
step three, adopting a machine learning classification algorithm, taking the optimal characteristic flow data set as the input of a classification model, training the classification model, and obtaining a classified classification model;
and step four, adopting the classified classification model obtained in the step three to classify the network traffic.
In the first step, an nfdpi tool is used to collect flow data, and then an nfs stream tool is used to analyze the flow data and mark a data set according to statistical characteristics to obtain an initial flow data set.
As a further optimization scheme of the network traffic classification method, the optimal characteristic traffic data set is obtained in the following way, and the method comprises two stages:
in the first stage: computing a relevance metric WSU (f) that measures characteristics of a network traffic classi|Cj)，WSU(fi|Cj) Representing the ith network traffic statistic fiWith the jth network traffic class CjThe degree of correlation between; WSU (f)i|Cj) The calculation steps are as follows:
step 1, calculating the ith network flow statistical characteristic fiWeighted information entropy H ofw(fi)：
Figure BDA0003286500490000021
Wherein, wjIs the weight parameter, p (f), for the jth network traffic classi) Is the ith network traffic statistical characteristic fiThe probability of occurrence in the initial traffic data set,
Figure BDA0003286500490000022
njis the jth network traffic class CjThe number in the initial traffic dataset, N always being the number of all samples in the initial traffic dataset;
step 2, calculating and considering the jth network traffic class CjThen, ith network flow statistic characteristic fiWeighted conditional entropy of (H)w(fi|Cj)：
Figure BDA0003286500490000023
Wherein, p (C)j) Represents the jth network traffic class CjProbability of occurrence in the initial traffic data set, p (f)i|Cj) The representation takes into account the jth network traffic class CjThen, ith network flow statistic characteristic fiThe conditional probability of (a);
step 3, calculating and considering the jth network traffic class CjThen, ith network flow statistic characteristic fiWeighted information gain IG ofw(fi|Cj)：
IGw(fi|Cj)＝Hw(fi)-Hw(fi|Cj)
Step 4, weighting information gain IGw(fi|Cj) Normalization or normalization is performed to obtain a weighted symmetric uncertainty metric WSU (f)i|Cj)：
Figure BDA0003286500490000031
Wherein Hw(Cj) Representing the jth network traffic class CjThe weighted information entropy of (1);
the second stage is as follows: the method adopts a subset search algorithm with low time complexity to output an optimal candidate characteristic flux data set, and comprises the following steps:
step I, calculating correlation measurement between all network traffic statistical characteristics and network traffic categories according to step 1-4, presetting a correlation measurement threshold value delta, and connecting the WSU (f)i|Cj) Network flow statistic characteristic output greater than delta and stored to array S'listPerforming the following steps;
step two, preparing S'listAccording to the statistical characteristics of WSU (f)i|Cj) The sizes of the two groups are arranged in descending order;
step three, selecting S'listMiddle WSU (f)i|Cj) The statistical characteristic of the network flow with the maximum value is taken as a main characteristic fp；
Step IV, at S'listSequentially select WSUs (f)i|Cj) Value less than fpThe v-th sub-feature f ofqvM-1. gtoreq.v.gtoreq.1, respectively comparing fqvAnd main characteristic fpWSU (f) therebetweenp|fqv)、fqvAnd CjWSU (f) therebetweenqv|Cj)；
Step five, if WSU (f)p|fqv)≥WSU(fqv|Cj) From S'listIn deleting the sub-feature fqv；
Step sixthly, repeating the step III to the state that S 'cannot be reached'listDeleting the feature;
step (c) of mixing'listSaving to the optimal characteristic flow data set SbestThereby obtaining an optimal characteristic traffic data set.
The flow control system based on the network flow classification method comprises a network flow classification module, an Open vSwitch switch and an Ryu controller, wherein,
the Open vSwitch switch is used for analyzing a data PACKET when the data PACKET is received, the analyzed data PACKET is matched with a flow table item IN the Open vSwitch switch, if the flow table item is matched, the current flow is controlled according to the indication of the flow table item, and if the flow table item is not matched, the data PACKET is sent to the Ryu controller through a PACKET _ IN message of a southward Openflow protocol;
the Ryu controller is used for communicating with the Open vSwitch switch through an Openflow protocol in the south direction and communicating with the network traffic classification module through an REST API in the north direction;
the network traffic classification module monitors a PACKET _ IN message reaching the Ryu controller through a northbound REST API, acquires the content of a data PACKET contained IN the PACKET _ IN message, analyzes the data PACKET, adopts an nfstop tool to analyze and acquire an initial traffic data set to be detected according to a statistical feature tag data set, extracts the features of the initial traffic data set to be detected, sends the initial traffic data set to a machine to learn and classify, connects the Ryu controller through the northbound REST API to send a PACKET _ OUT message according to the classification result, sends the classification result and the data PACKET back to the Open vSwitch switch, sends the traffic to the Open vSwitch switch through a W _ MOD message, and dispatches the data PACKET through the Open vSwitch switch; the flow table is obtained by the classification result.
As a further optimization scheme of the flow control system of the network traffic classification method according to the present invention, the scheduling refers to whether to leave an Open vSwitch switch or to which port to leave from the Open vSwitch switch.
Compared with the prior art, the invention adopting the technical scheme has the following technical effects:
the invention can realize higher-accuracy classification of the network traffic with unbalanced class distribution in the network, and improve the classification accuracy of the network traffic of a few classes while improving the overall accuracy of the classification model. Meanwhile, for the data packet received by the switch, a complete flow control system which realizes flow control according to a classification result from network flow acquisition, analysis and machine learning classification is realized by adopting an SDN network architecture.
Drawings
Fig. 1 is a general architecture diagram of a network traffic classification method and a flow control system based on the method.
Fig. 2 shows the signal transmission and the work flow of each plane module of the flow control system.
FIG. 3 is a flow chart of an algorithm for selecting a correlation feature and removing redundant features based on a correlation metric.
Figure 4 is an SDN network test topology.
Detailed Description
In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention will be described in detail with reference to the accompanying drawings and specific embodiments.
Reference herein to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the application. The appearances of the phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments mutually exclusive of other embodiments. It is explicitly and implicitly understood by one skilled in the art that the embodiments described herein can be combined with other embodiments.
Referring to fig. 1, fig. 1 is a general architecture diagram of a network traffic classification method and a flow control system based on the method, and the present invention is implemented by using the framework shown in fig. 1, and includes a network traffic classification module of an application plane in a three-layer architecture of an SDN, including network traffic data analysis, packet parsing, and network traffic machine learning classification; the Ryu controller developed based on Python is used on the control plane, the south of the development controller adopts an OpenFlow protocol to communicate with an Open vSwitch switch of the data plane, and the north interface adopts REST API to communicate with the application plane; and the data plane adopts an Open vSwitch switch, and realizes corresponding operations such as forwarding of data packets according to flow table items.
In one embodiment, the implementation of the network traffic classification module is an app application of the Ryu controller, and the functions of initial traffic data set acquisition, signature, machine learning classification, and the like are implemented. The method comprises the following steps:
step 1, adding a new network traffic classification application program file under an app folder of the Ryu controller.
And 2, completing calling and statement of the controller core library IN the added network flow classification application program file, and realizing inheritance of base classes such as ryu, base, controller, handler and the like and definition of functions, particularly monitoring the handler definition corresponding to the PACKET _ IN message event, and realizing communication with the controller.
And 3, developing a network flow collecting function and a network flow machine learning classification function.
In one embodiment, in the network traffic classification module of the application plane, the network traffic machine learning classification method is based on the feature selection of the correlation metric and the subset search algorithm of fig. 3, and the correlation metric is the sequential calculation of the weighted information entropy Hw(fi) Weighted conditional entropy Hw(fi|Cj) Weighted information gain IGw(fi|Cj) Finally, normalization is carried out on the weighted information gain to obtain weighted symmetric uncertainty WSU (f)i|Cj)。
In one embodiment, the flow of the subset search algorithm for feature selection in the network traffic classification module using the plane is shown in fig. 3. The input of the algorithm is a training set S and a threshold value, and correlation measurement WSU (f) between all network traffic statistical characteristics and network traffic categories is calculatedi|Cj) Then, WSU (f)i|Cj) Preserving the characteristic with value greater than threshold value to S'listAnd the features are according to WSU (f)i|Cj) The values are sorted in descending order. Wherein the function getFirstElement (S) represents taking the first element in the array S, and the function getNextElement (S, F) represents taking the next element in the array S. Therefore, Fp＝getFirstElement(S′list) Represents S'listFirst variable FpAs a main feature, Fq＝getNextElement(S′list,Fp) Represents S'listMiddle FpNext variable FqAs a sub-feature。FpAnd FqRefer to the expressions in the flow chart of fig. 3. Subsequent comparison WSU (f)p|fq) And WSU (f)p|Cj) The step of deleting features after size refers to the method in the flow chart of fig. 3. S 'obtained after completion of the circulation'listIs stored to SbestAnd obtaining an optimal characteristic flow data set.
In one embodiment, SDN architecture based flow control is implemented in an Open vSwitch switch. The Open vSwitch switch transmits a PACKET _ IN message to the Ryu controller through an OpenFlow protocol, and then a handler defined IN the network flow classification module acquires the PACKET _ IN message and analyzes the information of a data PACKET IN the PACKET _ IN message; then matching the flow table item according to the analyzed information and executing corresponding operation.
In one embodiment, the network traffic control system has a workflow as shown in fig. 2:
step 1, an Open vSwitch switch of a data plane receives a data PACKET, analyzes the data PACKET, matches a flow table item IN the switch, controls current flow according to an instruction if the flow table item is matched, and sends the data PACKET to a controller through a PACKET _ IN message of a southward Openflow protocol if the flow table item is not matched, so as to inquire how to process the data PACKET;
and step 2, the network traffic classification module of the application plane monitors the PACKET _ IN message reaching the controller through the northbound REST API and acquires the data PACKET content contained IN the PACKET _ IN message. Analyzing the data packet, adopting an nfstart tool to analyze, marking a data set according to statistical characteristics, and sending the data set to a machine for learning and classification;
step 3, the network FLOW classification module of the application plane sends a PACKET _ OUT message through the northbound REST API connection controller according to the classification result, sends the data PACKET back to the switch, and sends a FLOW table to the switch through the FLOW _ MOD message to indicate the operation executed after the data PACKET reaches the switch;
and 4, the Open vSwitch switch of the data plane schedules the data packet according to the corresponding operation indicated by the flow table item.
In one embodiment, the network topology is as shown in fig. 4, two Open vSwitch switches OSV1, OSW2 are interconnected through port 2, with a bandwidth of 10 Mbps; the host1 and the host2 are respectively connected, and the bandwidth is 100 Mbps; the Ryu controller is connected to port 1 of both OSV1 and OSW 2.
The technical features of the above embodiments can be arbitrarily combined, and for the sake of brevity, all possible combinations of the technical features in the above embodiments are not described, but should be considered as the scope of the present specification as long as there is no contradiction between the combinations of the technical features.
It should be noted that the terms "first \ second \ third" referred to in the embodiments of the present application merely distinguish similar objects, and do not represent a specific ordering for the objects, and it should be understood that "first \ second \ third" may exchange a specific order or sequence when allowed. It should be understood that "first \ second \ third" distinct objects may be interchanged under appropriate circumstances such that the embodiments of the application described herein may be implemented in an order other than those illustrated or described herein.
The terms "comprising" and "having" and any variations thereof in the embodiments of the present application are intended to cover non-exclusive inclusions. For example, a process, method, apparatus, product, or device that comprises a list of steps or modules is not limited to the listed steps or modules but may alternatively include other steps or modules not listed or inherent to such process, method, product, or device.
The above-mentioned embodiments only express several embodiments of the present application, and the description thereof is more specific and detailed, but not construed as limiting the scope of the invention. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the concept of the present application, which falls within the scope of protection of the present application. Therefore, the protection scope of the present patent shall be subject to the appended claims.

Claims (5)

1. A network traffic classification method is characterized by comprising the following steps:
step one, obtaining an initial flow data set S (F, C), wherein F is F ═ F1，f2，...fN}，C＝{C1，C2，...CMS (F, C) includes N network traffic statistical features F and M network traffic classes C, FiAs the ith network traffic statistic, CjThe j-th network flow category is N is more than or equal to i and more than or equal to 1, and M is more than or equal to j and more than or equal to 1;
cleaning the initial flow data set, selecting the correlation of the characteristics of the cleaned initial flow data set by adopting a characteristic selection algorithm, storing the selected characteristics to an optimal characteristic flow data set, and outputting the optimal characteristic flow data set;
step three, adopting a machine learning classification algorithm, taking the optimal characteristic flow data set as the input of a classification model, training the classification model, and obtaining a classified classification model;
and step four, adopting the classified classification model obtained in the step three to classify the network traffic.
2. The method of claim 1, wherein in the first step, an nfdpi tool is used to collect traffic data, and then an nfs stream tool is used to analyze the traffic data and obtain an initial traffic data set according to the statistical signature data set.
3. The method for classifying network traffic according to claim 1, wherein the optimal characteristic traffic data set is obtained in two stages as follows:
in the first stage: computing a relevance metric WSU (f) that measures characteristics of a network traffic classi|Cj)，WSU(fi|Cj) Representing the ith network traffic statistic fiWith the jth network traffic class CjThe degree of correlation between; WSU (f)i|Cj) The calculation steps are as follows:
step 1, calculating the ith network flow statistical characteristic fiWeighted information entropy H ofw(fi)：
Figure FDA0003286500480000011
Wherein, wjIs the weight parameter, p (f), for the jth network traffic classi) Is the ith network traffic statistical characteristic fiThe probability of occurrence in the initial traffic data set,
Figure FDA0003286500480000012
njis the jth network traffic class CjNumber in initial traffic data set, NGeneral assemblyIs the number of all samples in the initial traffic dataset;
step 2, calculating and considering the jth network traffic class CjThen, ith network flow statistic characteristic fiWeighted conditional entropy of (H)w(fi|Cj)：
Figure FDA0003286500480000021
Wherein, p (C)j) Represents the jth network traffic class CjProbability of occurrence in the initial traffic data set, p (f)i|Cj) The representation takes into account the jth network traffic class CjThen, ith network flow statistic characteristic fiThe conditional probability of (a);
step 3, calculating and considering the jth network traffic class CjThen, ith network flow statistic characteristic fiWeighted information gain IG ofw(fi|Cj)：
IGw(fi|Cj)＝Hw(fi)-Hw(fi|Cj)
Step 4, weighting information gain IGw(fi|Cj) Normalization or normalization is performed to obtain a weighted symmetric uncertainty metric WSU (f)i|Cj)：
Figure FDA0003286500480000022
Wherein Hw(Cj) Representing the jth network traffic class CjThe weighted information entropy of (1);
the second stage is as follows: the method adopts a subset search algorithm with low time complexity to output an optimal candidate characteristic flux data set, and comprises the following steps:
step I, calculating correlation measurement between all network traffic statistical characteristics and network traffic categories according to step 1-4, presetting a correlation measurement threshold value delta, and connecting the WSU (f)i|Cj) Network flow statistic characteristic output greater than delta and stored to array S'listPerforming the following steps;
step two, preparing S'listAccording to the statistical characteristics of WSU (f)i|Cj) The sizes of the two groups are arranged in descending order;
step three, selecting S'listMiddle WSU (f)i|Cj) The statistical characteristic of the network flow with the maximum value is taken as a main characteristic fp；
Step IV, at S'listSequentially select WSUs (f)i|Cj) Value less than fpThe v-th sub-feature f ofqvM-1. gtoreq.v.gtoreq.1, respectively comparing fqvAnd main characteristic fpWSU (f) therebetweenp|fqv)、fqvAnd CjWSU (f) therebetweenqv|Cj)；
Step five, if WSU (f)p|fqv)≥WSU(fqv|Cj) From S'listIn deleting the sub-feature fqv；
Step sixthly, repeating the step III to the state that S 'cannot be reached'listDeleting the feature;
step (c) of mixing'listSaving to the optimal characteristic flow data set SbestThereby obtaining an optimal characteristic traffic data set.
4. The traffic control system according to claim 1, comprising a network traffic classification module, an Open vSwitch switch and an Ryu controller, wherein,
the Open vSwitch switch is used for analyzing a data PACKET when the data PACKET is received, the analyzed data PACKET is matched with a flow table item IN the Open vSwitch switch, if the flow table item is matched, the current flow is controlled according to the indication of the flow table item, and if the flow table item is not matched, the data PACKET is sent to an Ryu controller through a PACKET _ IN message of a southward Openflow protocol;
the Ryu controller is used for communicating with the Open vSwitch switch through an Openflow protocol in the south direction and communicating with the network traffic classification module through an REST API in the north direction;
the network traffic classification module monitors a PACKET _ IN message reaching the Ryu controller through a northbound REST API, acquires the content of a data PACKET contained IN the PACKET _ IN message, analyzes the data PACKET, adopts an nfstop tool to analyze and acquire an initial traffic data set to be detected according to a statistical feature tag data set, extracts the features of the initial traffic data set to be detected, sends the initial traffic data set to a machine to learn and classify, connects the Ryu controller through the northbound REST API to send a PACKET _ OUT message according to the classification result, sends the classification result and the data PACKET back to the Open vSwitch switch, sends the traffic to the Open vSwitch switch through a W _ MOD message, and dispatches the data PACKET through the Open vSwitch switch; the flow table is obtained by the classification result.
5. The traffic control system according to claim 4, wherein the schedule indicates whether to leave the Open vSwitch switch and which port to leave from the Open vSwitch switch.
CN202111149697.5A 2021-09-29 2021-09-29 Network flow classification method and flow control system based on same Pending CN113965524A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202111149697.5A CN113965524A (en) 2021-09-29 2021-09-29 Network flow classification method and flow control system based on same

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202111149697.5A CN113965524A (en) 2021-09-29 2021-09-29 Network flow classification method and flow control system based on same

Publications (1)

Publication Number Publication Date
CN113965524A true CN113965524A (en) 2022-01-21

Family

ID=79463066

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202111149697.5A Pending CN113965524A (en) 2021-09-29 2021-09-29 Network flow classification method and flow control system based on same

Country Status (1)

Country Link
CN (1) CN113965524A (en)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104468403A (en) * 2014-11-14 2015-03-25 北京航空航天大学 SDN controller for performing network flow classification on data packets based on NACC
WO2016177146A1 (en) * 2015-08-24 2016-11-10 中兴通讯股份有限公司 Network traffic data classification method and device
CN111144459A (en) * 2019-12-16 2020-05-12 重庆邮电大学 Class-unbalanced network traffic classification method and device and computer equipment
WO2020119481A1 (en) * 2018-12-11 2020-06-18 深圳先进技术研究院 Network traffic classification method and system based on deep learning, and electronic device
CN112633314A (en) * 2020-10-15 2021-04-09 浙江工业大学 Active learning source tracing attack method based on multi-layer sampling

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104468403A (en) * 2014-11-14 2015-03-25 北京航空航天大学 SDN controller for performing network flow classification on data packets based on NACC
WO2016177146A1 (en) * 2015-08-24 2016-11-10 中兴通讯股份有限公司 Network traffic data classification method and device
WO2020119481A1 (en) * 2018-12-11 2020-06-18 深圳先进技术研究院 Network traffic classification method and system based on deep learning, and electronic device
CN111144459A (en) * 2019-12-16 2020-05-12 重庆邮电大学 Class-unbalanced network traffic classification method and device and computer equipment
CN112633314A (en) * 2020-10-15 2021-04-09 浙江工业大学 Active learning source tracing attack method based on multi-layer sampling

Similar Documents

Publication Publication Date Title
Zeng et al. $ Deep-Full-Range $: a deep learning based network encrypted traffic classification and intrusion detection framework
CN111953669A (en) Tor flow tracing and application type identification method and system suitable for SDN
CN110061931B (en) Industrial control protocol clustering method, device and system and computer storage medium
CN109299742A (en) Method, apparatus, equipment and the storage medium of automatic discovery unknown network stream
CN107704868A (en) Tenant group clustering method based on Mobile solution usage behavior
Zhao et al. A few-shot learning based approach to IoT traffic classification
CN108696453A (en) The power telecom network SDN Business Streams cognitive method and system of lightweight
CN108234452B (en) System and method for identifying network data packet multilayer protocol
CN114330469A (en) Rapid and accurate encrypted flow classification method and system
CN116405419A (en) Unknown network protocol classification method based on small sample learning
CN116827873A (en) Encryption application flow classification method and system based on local-global feature attention
CN110175655B (en) Data identification method and device, storage medium and electronic equipment
CN110958305A (en) Method and device for identifying terminal equipment of Internet of things
CN112367215B (en) Network traffic protocol identification method and device based on machine learning
CN106330768B (en) A kind of application and identification method based on cloud computing
CN108141377B (en) Early classification of network flows
CN113965524A (en) Network flow classification method and flow control system based on same
CN116401586A (en) Intelligent sensing and accurate classifying method for full scene service
CN111010695A (en) Channel allocation method based on channel idle time prediction
Zhang et al. Network traffic clustering with QoS-awareness
CN110544182B (en) Power distribution communication network fusion control method and system based on machine learning technology
CN114666282A (en) 5G flow identification method and device based on machine learning
CN110175635B (en) OTT application program user classification method based on Bagging algorithm
CN113271263B (en) Data processing method and equipment thereof
CN111291792A (en) Traffic data type integrated classification method and device based on double evolution

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
RJ01 Rejection of invention patent application after publication

Application publication date: 20220121

RJ01 Rejection of invention patent application after publication