CN113965524A - Network flow classification method and flow control system based on same - Google Patents
Network flow classification method and flow control system based on same Download PDFInfo
- Publication number
- CN113965524A CN113965524A CN202111149697.5A CN202111149697A CN113965524A CN 113965524 A CN113965524 A CN 113965524A CN 202111149697 A CN202111149697 A CN 202111149697A CN 113965524 A CN113965524 A CN 113965524A
- Authority
- CN
- China
- Prior art keywords
- data set
- network traffic
- flow
- network
- traffic
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 37
- 238000010801 machine learning Methods 0.000 claims abstract description 13
- 238000005259 measurement Methods 0.000 claims abstract description 7
- 238000004422 calculation algorithm Methods 0.000 claims abstract description 6
- 238000007635 classification algorithm Methods 0.000 claims abstract description 5
- 238000010845 search algorithm Methods 0.000 claims abstract description 5
- 238000013145 classification model Methods 0.000 claims description 10
- 238000010606 normalization Methods 0.000 claims description 5
- 238000004364 calculation method Methods 0.000 claims description 3
- 238000012549 training Methods 0.000 claims description 3
- 238000004140 cleaning Methods 0.000 claims description 2
- 239000000284 extract Substances 0.000 claims description 2
- 230000004907 flux Effects 0.000 claims description 2
- 230000006870 function Effects 0.000 abstract description 7
- 230000008569 process Effects 0.000 description 5
- 238000005516 engineering process Methods 0.000 description 3
- 238000011161 development Methods 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 238000011156 evaluation Methods 0.000 description 2
- 238000005457 optimization Methods 0.000 description 2
- 238000007781 pre-processing Methods 0.000 description 2
- 101100406608 Saccharomyces cerevisiae (strain ATCC 204508 / S288c) OSW2 gene Proteins 0.000 description 1
- 238000004458 analytical method Methods 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 238000007405 data analysis Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 230000014509 gene expression Effects 0.000 description 1
- 238000007689 inspection Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 230000008054 signal transmission Effects 0.000 description 1
- 238000012360 testing method Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L47/00—Traffic control in data switching networks
- H04L47/10—Flow control; Congestion control
- H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
- H04L47/2441—Traffic characterised by specific attributes, e.g. priority or QoS relying on flow classification, e.g. using integrated services [IntServ]
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N20/00—Machine learning
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Data Mining & Analysis (AREA)
- General Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Artificial Intelligence (AREA)
- Computer Vision & Pattern Recognition (AREA)
- General Physics & Mathematics (AREA)
- Evolutionary Computation (AREA)
- Physics & Mathematics (AREA)
- Bioinformatics & Computational Biology (AREA)
- Evolutionary Biology (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Medical Informatics (AREA)
- Life Sciences & Earth Sciences (AREA)
- Computing Systems (AREA)
- Mathematical Physics (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a network traffic classification method, which comprises the following steps: the method comprises the steps of reducing dimensions of an initial data set by using a feature selection algorithm based on an information theory, giving a threshold value of feature measurement, selecting a feature subset which can more measure unbalanced network flow from a high-dimensional data set, and further optimizing a classification algorithm by using an optimal candidate subset search algorithm with low complexity; the invention also discloses a flow control system based on the method, and the control system comprises: the method is characterized in that the flow control function is realized by adopting an SDN network architecture, a network flow classification module is embedded in an application plane, and the module is developed by utilizing an Ryu controller, so that the information such as network flow collection, machine learning classification, service types of different network flow categories and the like are output according to classification results.
Description
Technical Field
The invention relates to the technical field of network security, in particular to a network flow classification method and a flow control system based on the method.
Background
The network traffic classification is an important part of network management, QOS and network security, and in recent years, the importance of the network traffic classification is increasingly prominent with the increase of the scale of netizens and the popularity of the internet. The development of network traffic classification technology is changed from a port-based method to deep packet inspection-based method, and until 249 statistical characteristics of network traffic are described by a human system, the network traffic classification method based on machine learning is not deeply researched. However, due to the reasons that the collection of network traffic cannot be controlled, the network technology develops, that is, the amount of some kinds of network traffic increases rapidly, and the like, the network traffic increasingly presents a situation that the distribution of samples of each category is unbalanced. Data preprocessing, classification algorithm selection and model evaluation are indispensable processes in the field of machine learning, and whether a classification task is efficient or not is determined. Each process in the conventional machine learning method is designed to improve the overall accuracy or classification speed of the classification model, so as to ignore the classification accuracy of different classes of network traffic in the network traffic, and these few classes of network traffic, such as attach class traffic, are traffic classes that must be considered important in the network security field.
The network traffic classification technology based on machine learning can be deployed in a programmable and easily-extensible SDN network architecture, different controls are provided for classified traffic by utilizing strong network management and control capacity of an SDN, and different network resources are provided for different types of services.
Disclosure of Invention
The invention provides a network flow classification method and a flow control system based on the method, aiming at overcoming the defects of the prior art, and adopting a characteristic selection algorithm based on an information theory to reduce the dimension of an initial data set, giving a threshold value of characteristic measurement, and selecting a characteristic subset which can more measure unbalanced network flow from a high-dimensional data set; then selecting a proper classification algorithm to perform modeling learning and model evaluation on the data set subjected to the data preprocessing; embedding a network flow classification module in an application plane of a virtual SDN framework, developing the module by utilizing an Ryu controller, realizing network flow collection and machine learning classification, and executing different operations on different network flows according to classification results.
The invention adopts the following technical scheme for solving the technical problems:
the invention provides a network traffic classification method, which comprises the following steps:
step one, obtaining an initial flow data set S (F, C), wherein F is F ═ F1,f2,…fN},C={C1,C2,…CMS (F, C) includes N network traffic statistical features F and M network traffic classes C, FiAs the ith network traffic statistic, CjThe j-th network flow category is N is more than or equal to i and more than or equal to 1, and M is more than or equal to j and more than or equal to 1;
cleaning the initial flow data set, selecting the correlation of the characteristics of the cleaned initial flow data set by adopting a characteristic selection algorithm, storing the selected characteristics to an optimal characteristic flow data set, and outputting the optimal characteristic flow data set;
step three, adopting a machine learning classification algorithm, taking the optimal characteristic flow data set as the input of a classification model, training the classification model, and obtaining a classified classification model;
and step four, adopting the classified classification model obtained in the step three to classify the network traffic.
In the first step, an nfdpi tool is used to collect flow data, and then an nfs stream tool is used to analyze the flow data and mark a data set according to statistical characteristics to obtain an initial flow data set.
As a further optimization scheme of the network traffic classification method, the optimal characteristic traffic data set is obtained in the following way, and the method comprises two stages:
in the first stage: computing a relevance metric WSU (f) that measures characteristics of a network traffic classi|Cj),WSU(fi|Cj) Representing the ith network traffic statistic fiWith the jth network traffic class CjThe degree of correlation between; WSU (f)i|Cj) The calculation steps are as follows:
Wherein, wjIs the weight parameter, p (f), for the jth network traffic classi) Is the ith network traffic statistical characteristic fiThe probability of occurrence in the initial traffic data set,njis the jth network traffic class CjThe number in the initial traffic dataset, N always being the number of all samples in the initial traffic dataset;
Wherein, p (C)j) Represents the jth network traffic class CjProbability of occurrence in the initial traffic data set, p (f)i|Cj) The representation takes into account the jth network traffic class CjThen, ith network flow statistic characteristic fiThe conditional probability of (a);
IGw(fi|Cj)=Hw(fi)-Hw(fi|Cj)
Step 4, weighting information gain IGw(fi|Cj) Normalization or normalization is performed to obtain a weighted symmetric uncertainty metric WSU (f)i|Cj):
Wherein Hw(Cj) Representing the jth network traffic class CjThe weighted information entropy of (1);
the second stage is as follows: the method adopts a subset search algorithm with low time complexity to output an optimal candidate characteristic flux data set, and comprises the following steps:
step I, calculating correlation measurement between all network traffic statistical characteristics and network traffic categories according to step 1-4, presetting a correlation measurement threshold value delta, and connecting the WSU (f)i|Cj) Network flow statistic characteristic output greater than delta and stored to array S'listPerforming the following steps;
step two, preparing S'listAccording to the statistical characteristics of WSU (f)i|Cj) The sizes of the two groups are arranged in descending order;
step three, selecting S'listMiddle WSU (f)i|Cj) The statistical characteristic of the network flow with the maximum value is taken as a main characteristic fp;
Step IV, at S'listSequentially select WSUs (f)i|Cj) Value less than fpThe v-th sub-feature f ofqvM-1. gtoreq.v.gtoreq.1, respectively comparing fqvAnd main characteristic fpWSU (f) therebetweenp|fqv)、fqvAnd CjWSU (f) therebetweenqv|Cj);
Step five, if WSU (f)p|fqv)≥WSU(fqv|Cj) From S'listIn deleting the sub-feature fqv;
Step sixthly, repeating the step III to the state that S 'cannot be reached'listDeleting the feature;
step (c) of mixing'listSaving to the optimal characteristic flow data set SbestThereby obtaining an optimal characteristic traffic data set.
The flow control system based on the network flow classification method comprises a network flow classification module, an Open vSwitch switch and an Ryu controller, wherein,
the Open vSwitch switch is used for analyzing a data PACKET when the data PACKET is received, the analyzed data PACKET is matched with a flow table item IN the Open vSwitch switch, if the flow table item is matched, the current flow is controlled according to the indication of the flow table item, and if the flow table item is not matched, the data PACKET is sent to the Ryu controller through a PACKET _ IN message of a southward Openflow protocol;
the Ryu controller is used for communicating with the Open vSwitch switch through an Openflow protocol in the south direction and communicating with the network traffic classification module through an REST API in the north direction;
the network traffic classification module monitors a PACKET _ IN message reaching the Ryu controller through a northbound REST API, acquires the content of a data PACKET contained IN the PACKET _ IN message, analyzes the data PACKET, adopts an nfstop tool to analyze and acquire an initial traffic data set to be detected according to a statistical feature tag data set, extracts the features of the initial traffic data set to be detected, sends the initial traffic data set to a machine to learn and classify, connects the Ryu controller through the northbound REST API to send a PACKET _ OUT message according to the classification result, sends the classification result and the data PACKET back to the Open vSwitch switch, sends the traffic to the Open vSwitch switch through a W _ MOD message, and dispatches the data PACKET through the Open vSwitch switch; the flow table is obtained by the classification result.
As a further optimization scheme of the flow control system of the network traffic classification method according to the present invention, the scheduling refers to whether to leave an Open vSwitch switch or to which port to leave from the Open vSwitch switch.
Compared with the prior art, the invention adopting the technical scheme has the following technical effects:
the invention can realize higher-accuracy classification of the network traffic with unbalanced class distribution in the network, and improve the classification accuracy of the network traffic of a few classes while improving the overall accuracy of the classification model. Meanwhile, for the data packet received by the switch, a complete flow control system which realizes flow control according to a classification result from network flow acquisition, analysis and machine learning classification is realized by adopting an SDN network architecture.
Drawings
Fig. 1 is a general architecture diagram of a network traffic classification method and a flow control system based on the method.
Fig. 2 shows the signal transmission and the work flow of each plane module of the flow control system.
FIG. 3 is a flow chart of an algorithm for selecting a correlation feature and removing redundant features based on a correlation metric.
Figure 4 is an SDN network test topology.
Detailed Description
In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention will be described in detail with reference to the accompanying drawings and specific embodiments.
Reference herein to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the application. The appearances of the phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments mutually exclusive of other embodiments. It is explicitly and implicitly understood by one skilled in the art that the embodiments described herein can be combined with other embodiments.
Referring to fig. 1, fig. 1 is a general architecture diagram of a network traffic classification method and a flow control system based on the method, and the present invention is implemented by using the framework shown in fig. 1, and includes a network traffic classification module of an application plane in a three-layer architecture of an SDN, including network traffic data analysis, packet parsing, and network traffic machine learning classification; the Ryu controller developed based on Python is used on the control plane, the south of the development controller adopts an OpenFlow protocol to communicate with an Open vSwitch switch of the data plane, and the north interface adopts REST API to communicate with the application plane; and the data plane adopts an Open vSwitch switch, and realizes corresponding operations such as forwarding of data packets according to flow table items.
In one embodiment, the implementation of the network traffic classification module is an app application of the Ryu controller, and the functions of initial traffic data set acquisition, signature, machine learning classification, and the like are implemented. The method comprises the following steps:
And 2, completing calling and statement of the controller core library IN the added network flow classification application program file, and realizing inheritance of base classes such as ryu, base, controller, handler and the like and definition of functions, particularly monitoring the handler definition corresponding to the PACKET _ IN message event, and realizing communication with the controller.
And 3, developing a network flow collecting function and a network flow machine learning classification function.
In one embodiment, in the network traffic classification module of the application plane, the network traffic machine learning classification method is based on the feature selection of the correlation metric and the subset search algorithm of fig. 3, and the correlation metric is the sequential calculation of the weighted information entropy Hw(fi) Weighted conditional entropy Hw(fi|Cj) Weighted information gain IGw(fi|Cj) Finally, normalization is carried out on the weighted information gain to obtain weighted symmetric uncertainty WSU (f)i|Cj)。
In one embodiment, the flow of the subset search algorithm for feature selection in the network traffic classification module using the plane is shown in fig. 3. The input of the algorithm is a training set S and a threshold value, and correlation measurement WSU (f) between all network traffic statistical characteristics and network traffic categories is calculatedi|Cj) Then, WSU (f)i|Cj) Preserving the characteristic with value greater than threshold value to S'listAnd the features are according to WSU (f)i|Cj) The values are sorted in descending order. Wherein the function getFirstElement (S) represents taking the first element in the array S, and the function getNextElement (S, F) represents taking the next element in the array S. Therefore, Fp=getFirstElement(S′list) Represents S'listFirst variable FpAs a main feature, Fq=getNextElement(S′list,Fp) Represents S'listMiddle FpNext variable FqAs a sub-feature。FpAnd FqRefer to the expressions in the flow chart of fig. 3. Subsequent comparison WSU (f)p|fq) And WSU (f)p|Cj) The step of deleting features after size refers to the method in the flow chart of fig. 3. S 'obtained after completion of the circulation'listIs stored to SbestAnd obtaining an optimal characteristic flow data set.
In one embodiment, SDN architecture based flow control is implemented in an Open vSwitch switch. The Open vSwitch switch transmits a PACKET _ IN message to the Ryu controller through an OpenFlow protocol, and then a handler defined IN the network flow classification module acquires the PACKET _ IN message and analyzes the information of a data PACKET IN the PACKET _ IN message; then matching the flow table item according to the analyzed information and executing corresponding operation.
In one embodiment, the network traffic control system has a workflow as shown in fig. 2:
and step 2, the network traffic classification module of the application plane monitors the PACKET _ IN message reaching the controller through the northbound REST API and acquires the data PACKET content contained IN the PACKET _ IN message. Analyzing the data packet, adopting an nfstart tool to analyze, marking a data set according to statistical characteristics, and sending the data set to a machine for learning and classification;
and 4, the Open vSwitch switch of the data plane schedules the data packet according to the corresponding operation indicated by the flow table item.
In one embodiment, the network topology is as shown in fig. 4, two Open vSwitch switches OSV1, OSW2 are interconnected through port 2, with a bandwidth of 10 Mbps; the host1 and the host2 are respectively connected, and the bandwidth is 100 Mbps; the Ryu controller is connected to port 1 of both OSV1 and OSW 2.
The technical features of the above embodiments can be arbitrarily combined, and for the sake of brevity, all possible combinations of the technical features in the above embodiments are not described, but should be considered as the scope of the present specification as long as there is no contradiction between the combinations of the technical features.
It should be noted that the terms "first \ second \ third" referred to in the embodiments of the present application merely distinguish similar objects, and do not represent a specific ordering for the objects, and it should be understood that "first \ second \ third" may exchange a specific order or sequence when allowed. It should be understood that "first \ second \ third" distinct objects may be interchanged under appropriate circumstances such that the embodiments of the application described herein may be implemented in an order other than those illustrated or described herein.
The terms "comprising" and "having" and any variations thereof in the embodiments of the present application are intended to cover non-exclusive inclusions. For example, a process, method, apparatus, product, or device that comprises a list of steps or modules is not limited to the listed steps or modules but may alternatively include other steps or modules not listed or inherent to such process, method, product, or device.
The above-mentioned embodiments only express several embodiments of the present application, and the description thereof is more specific and detailed, but not construed as limiting the scope of the invention. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the concept of the present application, which falls within the scope of protection of the present application. Therefore, the protection scope of the present patent shall be subject to the appended claims.
Claims (5)
1. A network traffic classification method is characterized by comprising the following steps:
step one, obtaining an initial flow data set S (F, C), wherein F is F ═ F1,f2,...fN},C={C1,C2,...CMS (F, C) includes N network traffic statistical features F and M network traffic classes C, FiAs the ith network traffic statistic, CjThe j-th network flow category is N is more than or equal to i and more than or equal to 1, and M is more than or equal to j and more than or equal to 1;
cleaning the initial flow data set, selecting the correlation of the characteristics of the cleaned initial flow data set by adopting a characteristic selection algorithm, storing the selected characteristics to an optimal characteristic flow data set, and outputting the optimal characteristic flow data set;
step three, adopting a machine learning classification algorithm, taking the optimal characteristic flow data set as the input of a classification model, training the classification model, and obtaining a classified classification model;
and step four, adopting the classified classification model obtained in the step three to classify the network traffic.
2. The method of claim 1, wherein in the first step, an nfdpi tool is used to collect traffic data, and then an nfs stream tool is used to analyze the traffic data and obtain an initial traffic data set according to the statistical signature data set.
3. The method for classifying network traffic according to claim 1, wherein the optimal characteristic traffic data set is obtained in two stages as follows:
in the first stage: computing a relevance metric WSU (f) that measures characteristics of a network traffic classi|Cj),WSU(fi|Cj) Representing the ith network traffic statistic fiWith the jth network traffic class CjThe degree of correlation between; WSU (f)i|Cj) The calculation steps are as follows:
step 1, calculating the ith network flow statistical characteristic fiWeighted information entropy H ofw(fi):
Wherein, wjIs the weight parameter, p (f), for the jth network traffic classi) Is the ith network traffic statistical characteristic fiThe probability of occurrence in the initial traffic data set,njis the jth network traffic class CjNumber in initial traffic data set, NGeneral assemblyIs the number of all samples in the initial traffic dataset;
step 2, calculating and considering the jth network traffic class CjThen, ith network flow statistic characteristic fiWeighted conditional entropy of (H)w(fi|Cj):
Wherein, p (C)j) Represents the jth network traffic class CjProbability of occurrence in the initial traffic data set, p (f)i|Cj) The representation takes into account the jth network traffic class CjThen, ith network flow statistic characteristic fiThe conditional probability of (a);
step 3, calculating and considering the jth network traffic class CjThen, ith network flow statistic characteristic fiWeighted information gain IG ofw(fi|Cj):
IGw(fi|Cj)=Hw(fi)-Hw(fi|Cj)
Step 4, weighting information gain IGw(fi|Cj) Normalization or normalization is performed to obtain a weighted symmetric uncertainty metric WSU (f)i|Cj):
Wherein Hw(Cj) Representing the jth network traffic class CjThe weighted information entropy of (1);
the second stage is as follows: the method adopts a subset search algorithm with low time complexity to output an optimal candidate characteristic flux data set, and comprises the following steps:
step I, calculating correlation measurement between all network traffic statistical characteristics and network traffic categories according to step 1-4, presetting a correlation measurement threshold value delta, and connecting the WSU (f)i|Cj) Network flow statistic characteristic output greater than delta and stored to array S'listPerforming the following steps;
step two, preparing S'listAccording to the statistical characteristics of WSU (f)i|Cj) The sizes of the two groups are arranged in descending order;
step three, selecting S'listMiddle WSU (f)i|Cj) The statistical characteristic of the network flow with the maximum value is taken as a main characteristic fp;
Step IV, at S'listSequentially select WSUs (f)i|Cj) Value less than fpThe v-th sub-feature f ofqvM-1. gtoreq.v.gtoreq.1, respectively comparing fqvAnd main characteristic fpWSU (f) therebetweenp|fqv)、fqvAnd CjWSU (f) therebetweenqv|Cj);
Step five, if WSU (f)p|fqv)≥WSU(fqv|Cj) From S'listIn deleting the sub-feature fqv;
Step sixthly, repeating the step III to the state that S 'cannot be reached'listDeleting the feature;
step (c) of mixing'listSaving to the optimal characteristic flow data set SbestThereby obtaining an optimal characteristic traffic data set.
4. The traffic control system according to claim 1, comprising a network traffic classification module, an Open vSwitch switch and an Ryu controller, wherein,
the Open vSwitch switch is used for analyzing a data PACKET when the data PACKET is received, the analyzed data PACKET is matched with a flow table item IN the Open vSwitch switch, if the flow table item is matched, the current flow is controlled according to the indication of the flow table item, and if the flow table item is not matched, the data PACKET is sent to an Ryu controller through a PACKET _ IN message of a southward Openflow protocol;
the Ryu controller is used for communicating with the Open vSwitch switch through an Openflow protocol in the south direction and communicating with the network traffic classification module through an REST API in the north direction;
the network traffic classification module monitors a PACKET _ IN message reaching the Ryu controller through a northbound REST API, acquires the content of a data PACKET contained IN the PACKET _ IN message, analyzes the data PACKET, adopts an nfstop tool to analyze and acquire an initial traffic data set to be detected according to a statistical feature tag data set, extracts the features of the initial traffic data set to be detected, sends the initial traffic data set to a machine to learn and classify, connects the Ryu controller through the northbound REST API to send a PACKET _ OUT message according to the classification result, sends the classification result and the data PACKET back to the Open vSwitch switch, sends the traffic to the Open vSwitch switch through a W _ MOD message, and dispatches the data PACKET through the Open vSwitch switch; the flow table is obtained by the classification result.
5. The traffic control system according to claim 4, wherein the schedule indicates whether to leave the Open vSwitch switch and which port to leave from the Open vSwitch switch.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202111149697.5A CN113965524A (en) | 2021-09-29 | 2021-09-29 | Network flow classification method and flow control system based on same |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202111149697.5A CN113965524A (en) | 2021-09-29 | 2021-09-29 | Network flow classification method and flow control system based on same |
Publications (1)
Publication Number | Publication Date |
---|---|
CN113965524A true CN113965524A (en) | 2022-01-21 |
Family
ID=79463066
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN202111149697.5A Pending CN113965524A (en) | 2021-09-29 | 2021-09-29 | Network flow classification method and flow control system based on same |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN113965524A (en) |
Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN104468403A (en) * | 2014-11-14 | 2015-03-25 | 北京航空航天大学 | SDN controller for performing network flow classification on data packets based on NACC |
WO2016177146A1 (en) * | 2015-08-24 | 2016-11-10 | 中兴通讯股份有限公司 | Network traffic data classification method and device |
CN111144459A (en) * | 2019-12-16 | 2020-05-12 | 重庆邮电大学 | Class-unbalanced network traffic classification method and device and computer equipment |
WO2020119481A1 (en) * | 2018-12-11 | 2020-06-18 | 深圳先进技术研究院 | Network traffic classification method and system based on deep learning, and electronic device |
CN112633314A (en) * | 2020-10-15 | 2021-04-09 | 浙江工业大学 | Active learning source tracing attack method based on multi-layer sampling |
-
2021
- 2021-09-29 CN CN202111149697.5A patent/CN113965524A/en active Pending
Patent Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN104468403A (en) * | 2014-11-14 | 2015-03-25 | 北京航空航天大学 | SDN controller for performing network flow classification on data packets based on NACC |
WO2016177146A1 (en) * | 2015-08-24 | 2016-11-10 | 中兴通讯股份有限公司 | Network traffic data classification method and device |
WO2020119481A1 (en) * | 2018-12-11 | 2020-06-18 | 深圳先进技术研究院 | Network traffic classification method and system based on deep learning, and electronic device |
CN111144459A (en) * | 2019-12-16 | 2020-05-12 | 重庆邮电大学 | Class-unbalanced network traffic classification method and device and computer equipment |
CN112633314A (en) * | 2020-10-15 | 2021-04-09 | 浙江工业大学 | Active learning source tracing attack method based on multi-layer sampling |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
Zeng et al. | $ Deep-Full-Range $: a deep learning based network encrypted traffic classification and intrusion detection framework | |
CN111953669B (en) | Tor flow tracing and application type identification method and system suitable for SDN | |
TWI783229B (en) | Anomaly flow detection device and anomaly flow detection method | |
CN110061931B (en) | Industrial control protocol clustering method, device and system and computer storage medium | |
CN107704868A (en) | Tenant group clustering method based on Mobile solution usage behavior | |
CN108696453A (en) | The power telecom network SDN Business Streams cognitive method and system of lightweight | |
CN108234452B (en) | System and method for identifying network data packet multilayer protocol | |
CN114330469A (en) | Rapid and accurate encrypted flow classification method and system | |
CN116827873A (en) | Encryption application flow classification method and system based on local-global feature attention | |
CN110175655B (en) | Data identification method and device, storage medium and electronic equipment | |
CN110958305A (en) | Method and device for identifying terminal equipment of Internet of things | |
CN112367215B (en) | Network traffic protocol identification method and device based on machine learning | |
CN106330768B (en) | A kind of application and identification method based on cloud computing | |
CN112035286A (en) | Method and device for determining fault cause, storage medium and electronic device | |
CN108141377B (en) | Early classification of network flows | |
CN113965524A (en) | Network flow classification method and flow control system based on same | |
CN116401586A (en) | Intelligent sensing and accurate classifying method for full scene service | |
CN111010695A (en) | Channel allocation method based on channel idle time prediction | |
Zhang et al. | Network traffic clustering with QoS-awareness | |
CN110544182B (en) | Power distribution communication network fusion control method and system based on machine learning technology | |
CN114666282A (en) | 5G flow identification method and device based on machine learning | |
CN110175635B (en) | OTT application program user classification method based on Bagging algorithm | |
CN113271263B (en) | Data processing method and equipment thereof | |
CN111291792A (en) | Traffic data type integrated classification method and device based on double evolution | |
CN106888237A (en) | A kind of data dispatching method and system |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PB01 | Publication | ||
PB01 | Publication | ||
SE01 | Entry into force of request for substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
RJ01 | Rejection of invention patent application after publication |
Application publication date: 20220121 |
|
RJ01 | Rejection of invention patent application after publication |