KR20190091713A - Apparatus and method for classifying network traffic - Google Patents

Abstract

A method for classifying network traffic is disclosed. The method comprises the steps of: cleansing network traffic data collected via an interface of a network, at a processor; converting the cleansed network traffic data into a data set consisting of image data, at the processor; learning the data set to generate a recurrent neural networks (RNN) model, at the processor; and classifying a type of network traffic for a data flow using the generated RNN model, the data flow transmitted and received by network equipment connected to the network, at the processor.

Description

Network traffic classification device and its method {APPARATUS AND METHOD FOR CLASSIFYING NETWORK TRAFFIC}

The present invention relates to a technique for classifying network traffic using machine learning.

As the use of Internet-based applications increases rapidly, research is being conducted to efficiently operate limited network resources. This requires a way to accurately classify large amounts of network traffic.

Recently, researches for classifying network traffic using deep learning, which is one of machine learning techniques, have been conducted. Deep learning techniques include a multi-layer neural network (MNN) model, a convolutional neural network (CNN) model, and a recurrent neural network (RNN) model.

The RNN model, which is one of the deep learning techniques, is mainly used in the fields related to natural language processing such as speech recognition, language modeling, and translation. However, the study of classifying network traffic using the RNN model is still insufficient.

An object of the present invention is to provide a network traffic classification apparatus and method for classifying network traffic using an RNN model.

According to an aspect of the present invention, there is provided a method for classifying network traffic, the processor comprising: refining network traffic data collected through the network interface; Converting, in the processor, the purified network traffic data into a data set consisting of image data; At the processor, learning the data set to generate a Recurrent Neural Networks (RNN) model; And classifying, by the processor, a type of network traffic for the data flow using the generated RNN model for data flows transmitted and received by the network equipment connected to the network.

In accordance with another aspect of the present invention, a network traffic classification apparatus includes a network interface configured to access a network and collect network traffic data; Extracting a plurality of payloads by filtering the network traffic data, converting the extracted payloads into a data set represented by an image pattern, and learning the data set to generate a Recurrent Neural Networks (RNN) model A processor; And a repository for storing the RNN model generated by the processor.

According to the present invention, the network traffic is converted into a data set consisting of simple and understandable image data, the data set is learned to generate an RNN model, and the network traffic is utilized to classify the network traffic. Because the relationship between the flow structure and the type of network traffic does not have to be complicated to classify, it is easy to formulate a network traffic policy or plan.

In addition, since the RNN model generated in the present invention is generated from learning of a data set capable of representing network traffic in an image form (or image pattern), it is based on a flow characteristic of an image form (or image pattern) which has not been grasped conventionally. You can classify network traffic.

1 is a block diagram showing an entire system including a network traffic classification apparatus according to an embodiment of the present invention.
2 is a block diagram of a network traffic classification apparatus according to an embodiment of the present invention.
3 is a diagram illustrating flow information obtained by parsing a PCAP file according to an embodiment of the present invention.
4 is a diagram illustrating an example of a data set generated by a data conversion module according to an embodiment of the present invention.
5 to 8 are flowcharts illustrating a network traffic classification method according to an embodiment of the present invention.

Hereinafter, various embodiments of the present invention will be described in connection with the accompanying drawings. Various embodiments of the present invention may have various changes and various embodiments, and specific embodiments are illustrated in the drawings and related detailed descriptions are described. However, this is not intended to limit the various embodiments of the present invention to specific embodiments, it should be understood to include all modifications and / or equivalents and substitutes included in the spirit and scope of the various embodiments of the present invention. In the description of the drawings, similar reference numerals are used for similar elements.

Expressions such as "comprises" or "can include" as used in various embodiments of the present invention indicate the existence of the corresponding function, operation or component disclosed, and additional one or more functions, operations or It does not restrict the components. In addition, in various embodiments of the invention, the terms "comprise" or "have" are intended to indicate that there is a feature, number, step, action, component, part, or combination thereof described in the specification, one Or other features or numbers, steps, operations, components, parts or combinations thereof in any way should not be excluded in advance.

In various embodiments of the present invention, the expression "or" includes any and all combinations of words listed together. For example, "A or B" may include A, may include B, or may include both A and B.

Expressions such as "first," "second," "first," or "second," and the like used in various embodiments of the present invention may modify various elements of the various embodiments, but do not limit the corresponding elements. Do not. For example, the above expressions do not limit the order and / or importance of the corresponding elements. The above expressions may be used to distinguish one component from another. For example, both a first user device and a second user device are user devices and represent different user devices. For example, without departing from the scope of the various embodiments of the present invention, the first component may be referred to as the second component, and similarly, the second component may also be referred to as the first component.

When a component is said to be "connected" or "connected" to another component, the component may or may not be directly connected to or connected to the other component. It is to be understood that there may be new other components between the other components. On the other hand, when a component is referred to as being "directly connected" or "directly connected" to another component, it will be understood that there is no new other component between the component and the other component. Should be able.

The terms used in the embodiments of the present invention are merely used to describe specific embodiments, and are not intended to limit the embodiments of the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which embodiments of the present invention belong.

Terms such as those defined in the commonly used dictionaries should be construed as having meanings consistent with the meanings in the context of the related art, and are ideally or excessively formal unless otherwise defined in various embodiments of the present invention. It is not interpreted in the sense.

Several terms are defined before the description according to the embodiment of the present invention.

 Flow

A flow is a set of packets observed for a timeout period, in which packets share a number of attributes, such as the same source, the same destination, the same port, and the same IP protocol.

 A total number of flow

The number of flows is defined as the number of sets of packets that share a number of attributes, such as the same source, the same destination, the same port, and the same IP protocol.

 Recurrent Neural Networks Model

In the RNN model, input data is sequentially used as input of a hidden layer. The RNN model generates a new learning result by using previous learning information simultaneously with the next input when one input is inputted, and then the next input is sequentially entered through the learning cell. When the learning steps of the hidden layer of the RNN are completed, the final output result is shown through the final input and the immediately preceding learning result.

 Packet capture file

A PCAP file is a file that captures network packets and stores them in packet form.

 Application service

Application services are all kinds of application services that generate network traffic in network communication between terminals based on Well-Known standardized protocol. For example, BitTorrent, FTP, DNS, NTP, RDP (Remote, Desktop) Protocol), NETBIOS, Secure Shell (SSH), Web, Browser HTTP, Browser RTMP, and the like, but are not limited thereto.

1 is a block diagram showing an entire system including a network traffic classification apparatus according to an embodiment of the present invention.

Referring to FIG. 1, the entire system includes a network 100, a plurality of terminals 200 and 300, and a network classification device 400.

The network 100 is a concept including a plurality of sub-networks 110 and a plurality of network equipment (130 and 150), each sub-network 110 is a local area network (LAN), wide area network (Wide Area) Network (WAN) or a wired network such as a Value Added Network (VAN), or any kind of network, such as a wireless network such as a mobile radio network or a satellite network, and the like. And 150 is a network traffic generated in a communication process between the plurality of terminals 200 and 300 in the network 100, that is, to control the path of a series of packets, and the network equipment 130 may control the terminal 200. And control the path of the packets between the sub-network 110, and the network equipment 150 controls the path of the packets between the sub-network 110 and the terminal 300. To this end, the network equipment includes all types of communication devices for controlling or relaying communication between a plurality of terminals 200 and 300, such as a hub, a bridge, a switch, a router, and the like. Can be configured. In addition, the network 100 used herein refers to a concept including an access point (AP) that is directly or indirectly connected to a plurality of terminals 200 and 300 although not shown in the drawings. May be The access point is a Node B, a Radio Network Controller, an Evolved Node B (eNB), a Base Station Controller (BSC), a Base Transceiver Station: BTS, Base Station (BS), Transceiver Function (TF "), Basic Service Set (BSS), Extended Service Set (ESS), Radio Base Station : RBS) or some other terminology may comprise, be implemented, or known as.

Each of the plurality of terminals 200 and 300 is a subscriber station, a subscriber unit, a mobile station (MS), a remote station, a remote terminal. ), A user terminal (UT), a user agent, a user device, a thing device, user equipment, a user station, or Some other terminology may comprise, be implemented, or known as these. In some implementations, terminals 200 and 300 may include phones (eg, a cellular phone or smart phone), computers (eg, laptops (eg, a laptop), a tablet, a portable communication device, a portable computing device (eg, a personal data assistant), entertainment An entertainment device (eg, a music or video device, or a satellite radio), a global positioning system (GPS), or a wireless or wired medium ( any other suitable device configured to communicate via a wireless or wired medium.

The traffic monitoring devices 430 and 450 are devices for monitoring network traffic of the network devices 130 and 150, and the traffic monitoring device 430 is connected to the network device 130 to monitor the network traffic of the network device 130. The traffic monitoring apparatus 450 connects to the network equipment 150 and monitors network traffic of the network equipment 130. The traffic monitoring devices 430 and 450 are provided on the carrier side. In the example of FIG. 1, the network devices 130 and 150 and the traffic monitoring devices 430 and 450 are physically separated from each other. Network equipment 130 and 150 may be included in traffic monitoring devices 430 and 450.

The network traffic classifying apparatus 400 classifies the network traffic data provided from the network equipment 130 and 150 or the traffic monitoring apparatuses 410 and 430 by using the RNN model. Will be described in detail with reference to FIG.

2 is a block diagram of a network traffic classification apparatus according to an embodiment of the present invention.

Referring to FIG. 2, the network traffic classification apparatus 500 includes, in terms of hardware architecture, a processor 510, a storage 520, a network interface 530, and a user interface 540. It can be configured to.

The processor 510 is a hardware device for executing software stored in the memory 520, configured to execute various software for classifying network traffic data based on the RNN model. The processor 510 may be a custom or general purpose processor, a central processing unit (CPU), a semiconductor based microprocessor, a macro processor, or any device generally for executing software instructions.

The storage 520 is a configuration for storing various software executed by the processor 510 and includes nonvolatile memory elements such as DRAM, SRAM, SDRAM, and the like, and non-volatile memory elements such as ROM, EPROM, EEPROM, PROM, tape, CD-ROM, disk, and the like. It can include any one or combination of volatile memory elements. Software stored in storage 520 may include one or more separate programs for classifying network traffic. Each program may be, for example, a program associated with a process of refining network traffic data, a program associated with a process of converting refined data to a data set, a program associated with a process of learning a data set to generate an RNN model, and generated. An RNN model, a program related to a process of classifying data flows transmitted and received by the traffic monitoring apparatuses 430 and 450 based on the generated RNN model, and an operating system that provides an execution environment for these programs may be included.

Each program may be in the form of a source program, an executable program (eg, object code), script, or any other entity including a set of instructions. have. In addition, each program may be modified through a compiler, an assembler, an interpreter, and the like. In addition, each program can be written by an object-oriented programming language or by procedure programming with routines, subroutines and / or functions.

The network interface 530 is a hardware device connectable to the network 100 or 110, the network equipment 130 and 150 within the network 100, or the traffic monitoring devices 430 and 450 connected to the network equipment 130 and 150. Network traffic data may be collected from the network equipment 130 and 150 or the traffic monitoring devices 430 and 450, processed into processed data, and transmitted to the processor 510. The network interface 530 may be, for example, a network interface card (NIC), a network adapter, or the like.

The user interface 540 is for interfacing the user 10 with the network traffic classifying apparatus 500 and may include an input device such as a keyboard or a mouse and an output device such as a printer, a scanner, a speaker, a display, or the like.

As such, the network traffic classification apparatus 500 configured to include the above-described components 510, 520, 530, and 540 may be referred to as an 'electronic device' or a 'computing device'. When the electronic device or computing device is operating, the processor 510 communicates with the storage 520 to read and execute the software associated with network traffic classification and RNN model generation for network traffic classification.

The processor 510 may be configured to include a number of modules 510A-510E as shown in FIG. 2 to perform logical functions of software stored in the storage 520. Each module may be implemented as a logic circuit from a hardware architecture point of view. Hereinafter, the modules 510A to 510E included (or embedded) in the processor 510 will be described in detail.

Control module (510A)

The control module 510A controls and manages operations of the peripheral modules 510B to 510F and the components 520, 530, and 540 provided outside the processor 510. For example, the control module 510A determines the operation order of the peripheral modules 510B-510F and the configurations 520, 530, and 540, and determines the peripheral modules 520-580 and the configuration according to the determined operation sequence. Instructs and controls the operations of the fields 520, 530, and 540, or process the data generated by any one of the peripheral modules 520 ˜ 580 to be processed by another module.

Data Acquisition Module (510B)

The data collection module 510B collects network traffic data transmitted and received by the network equipment 130 and 150 or the traffic monitoring devices 430 and 450 through the network interface 530 connected to the network 100 or 110. In terms of a hardware architecture, the data collection module 510B may be implemented as a hardware module or a kind of 'buffer memory' that temporarily stores network traffic data in a predetermined unit and outputs the data in a predetermined unit.

Network traffic data collected by the data collection module 510B may be used as a term referring to a packet capture (PCAP) file or a file or data including the same. A PCAP file is a file that captures network traffic (or packets).

The structure of a PCAP file includes fields delimited by 'headers' and fields delimited by' payloads'.The header contains full information describing the PCAP file, the length of the captured packet data, the source IP, the source port, and the destination IP. The destination port, protocol, time information of capturing network traffic (or packet), a flow identifier for identifying a flow, and information for distinguishing a type of an application service may be recorded. The actual packet data is recorded in the payload.

Data Purification Module (510C)

The data refining module 510C performs a process of refining network traffic data, that is, PCAP files. To this end, when the network traffic classification apparatus 500 starts to operate, the data refining module 420 communicates with the storage 520 in which the program for refining the PCAP file is stored, according to an instruction of the control module 510A. The PCAP file is refined by reading and executing the program.

In detail, the data refining module 420 parses the PCAP file collected by the data collection module 510B, and based on the flow identifier recorded in the header of the PCAP file and information for identifying the type of the application service, etc. FIG. 3. Acquire flow information classified for each application service as shown in FIG. In the flow information illustrated in FIG. 3, an application service 20 including BitTorrent, SKYPE, RDP, SSH, and Web is illustrated. Flow information divided by each application service includes a total number of flows (21), a total number of packets constituting all flows (22, a total number of packets), and an average number of packets in one flow ( 23, Average number of packets in a flow), Total packet size (24), Average size of all packets in a flow (25), for all flows Average packet size over all flows (26), Min packet size over all flows (27) and Max packet size over all flows (28) ) May be included.

The data refining module 510C performs a process of selecting application services based on the total number 21 of flows in the flow information. For example, the data refining module 510C may select application services in which the total number 21 of flows is equal to or greater than a reference number of preset flows. This is to select an application service that provides enough training data to generate the RNN model described below. In the example of FIG. 3, when the reference number of the preset flow is 30,000, the selected application service is rdp, ssh, or bittorrent.

The data refining module 510C sorts all packets in the flow of the selected application services in the order in which they occurred over time, and includes the top N packets, where N is a natural number of two or more, including the packet sorted first in this order. To extract the data from all the packets, and through the process of extracting the payload of the extracted packets, respectively, to filter the PCAP file (network traffic data), to complete the data purification process to reduce. Here, the reason for selecting the top N packets in chronological order among all packets in the flow is that the probability of retrieving the structural features of the flow is high in the packets initially generated in the network communication. The number N for selecting packets may be set to various values depending on the design in consideration of the system load.

Data Conversion Module (510D)

The data conversion module 510D is configured to perform network traffic data refined by the data refining module 510C, that is, network traffic data based on data conversion rules that define a mapping relationship between payload and gray scale. Or converting the payloads generated by the filtering and abbreviation of the PCAP file) into a data set consisting of image data. The image data may be, for example, gray data. The data set may be represented in a matrix form that includes a plurality of elements consisting of rows and columns. The data conversion rule may be stored in the storage 520 and may be loaded from the storage 520 into the data conversion module 510D according to a call command of the data conversion module 510D or a control command of the control module 510A. have.

When one payload is composed of M bits, the data conversion module 510D divides the M bits into specific bit units (eg, 1 bit, 2 bit, 4 bit, or 8 bit), so that a plurality of A bit group is generated, and the generated bit groups are converted according to the data conversion rule to generate a plurality of gray data.

The data conversion module 510D converts the network traffic data purified by the data refining module 510C into a data set composed of image data by generating the matrix data set having the plurality of gray data as elements. Complete the process. 4 shows an example of a data set generated by the data conversion module 510D, and an example of the data set includes elements 0, 1, 2, 3, 4, 6, 11 and decimals representing a plurality of gray data as decimal numbers. It is expressed in the form of 10x8 matrix consisting of 13). In FIG. 4, for easy understanding of the description, the elements of the matrix are represented in decimal, and the actual elements are not composed of decimal.

Learning Module (510E)

The learning module 510E learns a data set consisting of image data by machine learning to generate an RNN model that predicts the relationship between the data set and the type of network traffic and stores it in the storage 520 or in the storage 520. Perform the process of updating a previous saved RNN model.

Sorting Module (510F)

The classification module 510F calls the RNN model stored in the storage 520 by the learning module 510E to call the data flow transmitted and received by the network equipment 130 and 150 or the traffic monitoring devices 430 and 450. A process of classifying the types of network traffic for the data flow is performed by configuring the input data of the RNN model.

The control module 510A may establish, modify, and supplement a traffic policy including specific traffic refinement management, traffic congestion detection, traffic congestion control, etc. based on the classification result by the classification module 510F. The establishment, modification, and supplementation of such traffic policy may be performed by the classification module 510F.

When the RNN model generated in the learning module 510E is provided to a server of a communication service provider side (not shown), the communication service provider may modify and supplement a predetermined traffic policy by using the provided RNN model.

As such, the network traffic classification apparatus 500 according to an embodiment of the present invention

Flow structure to classify network traffic by converting network traffic into a data set consisting of simple and understandable image data, learning these datasets to generate RNN models, and using these RNN models to classify network traffic. Because the relationship between the network and network traffic does not need to be complicated rules, network traffic policies or plans can be easily established.

In addition, since the RNN model generated by the network traffic classification apparatus 500 according to an embodiment of the present invention is generated from learning of a data set in which network traffic is expressed in an image form (or image pattern), it has not been known in the past. Network traffic may be classified based on flow characteristics in image form (or image pattern).

5 is a flowchart illustrating a network traffic classification method according to an embodiment of the present invention. In the process of describing the following steps, contents overlapping with those described with reference to FIGS. 1 to 4 will be briefly described or omitted.

Referring to FIG. 5, first, in step S510, a process of collecting network traffic data is performed by the network interface 530 connected to the network 100. In this case, the network traffic data may be a PCA file or data including the same.

Subsequently, in step S520, a process of purifying the collected network traffic data is performed by the processor 510.

Subsequently, in step S530, a process of converting the purified network traffic data into a data set composed of image data is performed by the processor 510. For example, the refined network traffic data may be converted into the data set according to a data conversion rule, and the data conversion rule defines a mapping relationship between gray scale and payload extracted in the step of refining the network traffic data. It can be a rule.

Subsequently, in step S540, the processor 510 performs a process of learning the data set to generate a Recurrent Neural Networks (RNN) model.

Subsequently, in step S550, the network monitoring apparatus 430 and the network equipment 130 and 150 connected to the network 110 or the network operator 130 and 150 connected to the network equipment 130 and 150 are connected by the processor 510. A process of classifying the type of network traffic for the data flow is performed using the generated RNN model for the data flow transmitted and received at 450.

FIG. 6 is a detailed flowchart of step S520 shown in FIG. 5.

Referring to FIG. 6, in order to purify network traffic data according to the above-described step S520, first, in step S521, a process of parsing the collected network traffic data to obtain flow information for each application service is performed. Flow information includes the number of flows for each application service. An example of flow information is shown in FIG. The number of flows for each application service is, for example, parsing network traffic data, i.e., a PCAP file, extracting a flow identifier recorded in the header of the PCAP file, and information for identifying the type of application service, and flows for each application service. It can be obtained by counting the number of identifiers.

Subsequently, in step S523, a process of selecting an application service having the number of the flows equal to or greater than a preset reference number is performed from the number of flows for each application service.

Then, in step S525, a process of extracting a plurality of packets included in the flow of the selected application service is performed.

Then, in step S527, a process of extracting a plurality of payloads from the plurality of packets and generating the extracted plurality of payloads as the purified network traffic data is performed.

FIG. 7 is a detailed flowchart of step S525 shown in FIG. 6.

Referring to FIG. 7, according to the above-described step S525, in order to extract a plurality of packets, first, in step S525-1, a process of aligning the plurality of packets included in the flow in the selected application service in time order is performed. do.

Subsequently, in step S525-3, a process of extracting, as the plurality of packets, the upper N packets having a high probability of retrieving a structural feature of the flow from among the plurality of packets arranged in time order are performed.

FIG. 8 is a detailed flowchart of step S530 shown in FIG. 5 shown in FIG.

Referring to FIG. 8, in order to convert the purified network traffic data into a data set composed of image data according to the above-described step S530, first, in step S531, the payload extracted in the step of purifying the network traffic data The process of generating a plurality of bit groups is performed by dividing the bits constituting the bit into specific bit units.

Then, in step S533, a process of converting the plurality of bit groups into a plurality of gray data, respectively, is performed based on the data conversion rule.

Subsequently, in step S535, a process of generating the data set in the form of a matrix having the plurality of gray data as an element is performed.

Although the present invention has been described above with reference to the embodiments, these are only examples and are not intended to limit the present invention, and those skilled in the art to which the present invention pertains may have an abnormality within the scope not departing from the essential characteristics of the present invention. It will be appreciated that various modifications and applications are not illustrated. For example, each component specifically shown in the embodiment of the present invention can be modified. And differences relating to such modifications and applications will have to be construed as being included in the scope of the invention defined in the appended claims.

Claims (16)

In the network traffic classification method in a network traffic classification apparatus comprising a network interface connected to a network and a processor connected to the network interface,
At the processor, refining network traffic data collected via the network interface;
Converting, in the processor, the purified network traffic data into a data set consisting of image data;
At the processor, learning the data set to generate a Recurrent Neural Networks (RNN) model; And
Classifying, by the processor, a type of network traffic for the data flow using the generated RNN model for a data flow transmitted and received by the network equipment connected to the network;
Network traffic classification method comprising a.
The method of claim 1, wherein the refining of the network traffic data comprises:
Parsing the network traffic data to obtain flow information for each application service, and selecting an application service having a number of flows greater than or equal to a reference number from among the number of flows for each application service based on the obtained flow information;
Extracting a plurality of packets included in the flow of the selected application service;
Extracting a plurality of payloads from the plurality of packets; And
Generating the extracted plurality of payloads as the purified network traffic data
Network traffic classification method comprising a.
The method of claim 2, wherein the extracting of the plurality of packets comprises:
Arranging a plurality of packets included in the flow in the selected application service in chronological order; And
Extracting, as the plurality of packets, the upper N packets having a high probability of retrieving a structural feature of a flow among the plurality of packets arranged in chronological order
Network traffic classification method comprising a.
The method of claim 1, wherein the network traffic data,
A network traffic classification method that is a packet capture (PCAP) file.
The method of claim 1, wherein the converting to the data set comprises:
And converting the refined network traffic data into the data set based on a data conversion rule that defines a mapping relationship between gray scale and the payload extracted in the step of refining the network traffic data. .
The method of claim 1, wherein the converting to the data set comprises:
Generating a plurality of bit groups by dividing the bits constituting the payload extracted in the step of refining the network traffic data into specific bit units;
Generating the plurality of gray data by converting the plurality of bit groups according to a data conversion rule that defines a mapping relationship between the gray scale and the payload; And
Generating the data set in matrix form using the plurality of gray data as elements
Network traffic classification method comprising a.
The method of claim 1, wherein generating the RNN model comprises:
Learning the data set by machine learning to generate the RNN model for predicting a relationship between the data set and a type of network traffic.
In the network traffic classification apparatus comprising a network interface for connecting to the network and a processor connected to the network interface,
A network interface for network connection to collect network traffic data;
Extracting a plurality of payloads by filtering the network traffic data, converting the extracted payloads into a data set represented by an image pattern, and learning the data set to generate a Recurrent Neural Networks (RNN) model A processor; And
A repository for storing the RNN model generated by the processor
Network traffic classification device comprising a.
The processor of claim 8, wherein the processor comprises:
And classifying the type of network traffic for the data flow using the RNN model stored in the storage of the data flow transmitted and received by the network equipment connected to the network.
The processor of claim 8, wherein the processor comprises:
Parse the network traffic data to obtain flow information for each application service, and select an application service having the number of the flows equal to or greater than a reference number from among the number of flows for each application service based on the obtained flow information. And extracting the plurality of packets included in the flow and extracting the plurality of payloads from the plurality of packets.
The processor of claim 10, wherein the processor comprises:
Arranging the plurality of packets included in the flow of the selected application service in chronological order, and extracting, as the plurality of packets, the top N packets having a high probability of retrieving a structural feature of the flow among the plurality of packets arranged in the chronological order The network traffic classification apparatus.
The method of claim 8, wherein the network traffic data,
A network traffic classification device that is a packet capture (PCAP) file.
The processor of claim 8, wherein the processor comprises:
And converting the extracted plurality of payloads into a data set represented by an image pattern based on a data conversion rule that defines a mapping relationship between a gray scale representing the image pattern and a payload.
The method of claim 13, wherein the reservoir,
And storing the data conversion rule.
The processor of claim 8, wherein the processor comprises:
By dividing the bits constituting each of the plurality of payloads into specific bit units, generating a plurality of bit groups, and converting the plurality of bit groups according to a data conversion rule that defines a mapping relationship between gray scale and payload. Generating a plurality of gray data and generating the data set in a matrix form having the plurality of gray data as elements.
The processor of claim 8, wherein the processor comprises:
And machine learning the data set to generate the RNN model for predicting a relationship between the data set and a type of network traffic.

Images