WO2021103135A1 - 一种基于深度神经网络的流量分类方法、系统及电子设备 - Google Patents

一种基于深度神经网络的流量分类方法、系统及电子设备 Download PDF

Info

Publication number
WO2021103135A1
WO2021103135A1 PCT/CN2019/124267 CN2019124267W WO2021103135A1 WO 2021103135 A1 WO2021103135 A1 WO 2021103135A1 CN 2019124267 W CN2019124267 W CN 2019124267W WO 2021103135 A1 WO2021103135 A1 WO 2021103135A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
flow
features
data set
dimensional
Prior art date
Application number
PCT/CN2019/124267
Other languages
English (en)
French (fr)
Inventor
叶可江
赵世林
纪书鉴
须成忠
Original Assignee
中国科学院深圳先进技术研究院
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国科学院深圳先进技术研究院 filed Critical 中国科学院深圳先进技术研究院
Publication of WO2021103135A1 publication Critical patent/WO2021103135A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
    • H04L47/2441—Traffic characterised by specific attributes, e.g. priority or QoS relying on flow classification, e.g. using integrated services [IntServ]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/045—Combinations of networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H04L41/142—Network analysis or design using statistical or mathematical methods
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H04L41/145—Network analysis or design involving simulating, designing, planning or modelling of a network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H04L41/147—Network analysis or design for predicting network behaviour

Definitions

  • This application belongs to the technical field of network data classification, and in particular relates to a method, system and electronic device for traffic classification based on a deep neural network.
  • network traffic classification technology is the process of identifying network applications and traffic classification. It is a key link in modern network security and resource management systems. How to accurately classify and identify these network traffic to improve network security levels, provide accurate network services, and provide customers with better services is still a big challenge.
  • network traffic classification technology mainly includes two parts: traditional network traffic classification and current machine learning-based network traffic classification. Among them:
  • Port-based traffic classification method by analyzing and extracting some network applications or protocols that use fixed network ports, some of the port numbers are registered with the Internet Assigned Numbers Agency (IANA). By comparing with the IANA list one by one, you can know which application or which network protocol the network traffic belongs to, which has a good classification effect.
  • IANA Internet Assigned Numbers Agency
  • Load-based traffic classification method by extracting the load content of each IP network packet, including the characteristics of the network transmission protocol, network data content, and the byte size of the transmission packet. Different network applications or transmission protocols will produce different network behaviors or network traces when surfing the Internet. This method can perform efficient traffic classification based on this network characteristic, but the drawback is that it cannot analyze encrypted traffic.
  • Network traffic classification technology based on machine learning It mainly includes classification methods based on supervised learning and classification methods based on unsupervised learning. These two types of machine learning technologies have been widely used in the field of network traffic classification research.
  • the classification process is shown in Figure 1, and is generally divided into four steps: data preprocessing (Preprocessing), training and learning (Training), model evaluation (Evaluation), and prediction (Prediction).
  • a) Classification method based on supervised learning Learn the potential knowledge between the data from the labeled training data, and carry out intensive training on this set of knowledge to form a model with classification learning experience to predict the label of the new data. Through continuous optimization of the model, to achieve the desired output effect.
  • Wang Binfeng et al. invented a noisy network traffic classification modeling method based on statistical characteristics, which includes: Step 1. Network data collection and processing, real-time extraction of network traffic data from network traffic monitoring stations, and pre-processing of network traffic data Processing; Step 2. Establish a network traffic noise judgment model and remove the noise in the network traffic data; Step 3. Establish a network traffic noise tolerance model; Step 4. According to the network traffic noise judgment model and network traffic described in Steps 2 and 3 Noise tolerance model, establish a robust classification model; Step 5, use the random forest classification method, use the online network traffic data as the test set, and use the robust classification model for classification.
  • Zhang Yu et al. invented a network traffic classification method based on the fusion algorithm of K_means and KNN. Their method framework is to construct a two-classifier for each application protocol, and the output of all the classifiers is integrated into the final output by the decision rule.
  • the algorithm also integrates the unsupervised K_means algorithm and the supervised KNN algorithm.
  • the method also proposes a feature selection algorithm based on K_means iteration. The purpose is to select high-resolution features to save time, space and improve classification. effect.
  • the existing machine learning-based network traffic classification technology has better classification results than traditional network traffic classification methods, it also has many drawbacks, mainly including: manual feature extraction, which requires a lot of manpower Material resources; the density of existing traffic features is small, and network applications and protocol traffic features cannot be deeply utilized; the existing network traffic classification model is not very robust. As long as the data environment of network traffic changes, the model must be retrained Learning its characteristics, the classification effect obtained is not very good.
  • This application provides a method, system and electronic device for traffic classification based on a deep neural network, which aims to solve one of the above technical problems in the prior art at least to a certain extent.
  • a traffic classification method based on a deep neural network including the following steps:
  • Step a Perform feature extraction on the original network traffic, generate various types of network flow data, and mark the network flow data according to the network log to generate a data set for building a deep neural network; where the extracted features include each Three-dimensional characteristics of forward flow, reverse flow, and transmission flow of a network flow;
  • Step b Restructure the data set structure, and train the CNN network through the reconstructed data set.
  • the CNN network calculates the forward flow and reverse flow features and forward flow in each network flow based on the extracted three-dimensional features. Correlation coefficient matrix between the characteristics of the transport stream, the reverse flow and the transport stream, and output high-dimensional global convolution features;
  • Step c Input the global convolution feature output by the CNN network into the LSTM network for training, and output the traffic classification prediction result.
  • the technical solution adopted in the embodiment of the present application further includes: the step a further includes: collecting original network traffic and obtaining corresponding network logs; wherein, the original network traffic is collected through a network data center or a simulated local area network environment, and The content of the web log includes the interaction between web applications, the transmission load of the web applications and the server.
  • the technical solution adopted in the embodiment of the present application further includes: in the step a, the feature extraction of the original network traffic, generating various types of network flow data, and marking the network flow data according to the network log specifically includes:
  • Step a1 Combine the network packets ⁇ packet_1,packet_2,...,packet_n ⁇ with the same 5-tuple ⁇ source IP, source Port, destination IP, destination Port, transmission protocol (TCP,UDP) ⁇ into the corresponding network flow
  • Step a2 Extract packet characteristics ⁇ Size-packet,Interval-packet,... ⁇ , flow characteristics ⁇ Length-flow,Flow packet-per,... ⁇ , state connection characteristics ⁇ Flag-Cnt,Active,... ⁇ , and each network ⁇ Forward flow (client->server), reverse flow (server->client), transport flow (tcp, udp) ⁇ three-dimensional features;
  • Step a3 Check the five fields ⁇ source IP, source Port, destination IP, destination Port, transport protocol (TCP, UDP) ⁇ in the network log and each network flow, if the network flow and the network log have the same five yuan Group, the label of the network flow is marked as the corresponding network application or protocol in the network log.
  • TCP transport protocol
  • the technical solution adopted in the embodiment of the present application further includes: the step a further includes: preprocessing and normalizing the data set.
  • the training process of the convolutional neural network specifically includes:
  • Step b1 Input the labeled data set into the convolutional neural network
  • Step b2 Based on the extracted three-dimensional features, respectively calculate the correlation coefficient matrix between the forward flow and reverse flow characteristics, the forward flow and the transmission flow characteristics, the reverse flow and the transmission flow characteristics in each network flow, and generate a three-dimensional Characteristic network flow data set structure;
  • Step b3 In order to adapt to the data input format of the convolutional neural network, the data set format is transformed to (None, 25, 25, 3); among them, the transformed data format (None, 25, 25, 3) can be regarded as 25x25 color picture with 3 channels;
  • Step b4 Use the transformed data set to train the convolutional neural network to obtain high-dimensional global convolution features.
  • the convolutional neural network includes a convolutional layer, a pooling layer, and a fully connected layer; the convolutional layer is used to extract local characteristics; the The pooling layer is used to divide the high-dimensional features generated after convolution into several regions, and the maximum or average value of each region is taken to obtain new smaller-dimensional features; the fully connected layer is used to divide all high-dimensional features The feature is converted to a global feature.
  • the technical solution adopted in the embodiment of this application also includes: in the step c, after the LSTM network is trained, a multi-dimensional sequence correlation flow (Corr-Flow Vector) vector feature is obtained; then the fully connected layer is connected, and the softmax is used as the activation function , Output the predicted probability matrix of each class, and finally get the traffic classification prediction result.
  • a multi-dimensional sequence correlation flow Corr-Flow Vector
  • the technical solution adopted in the embodiment of the present application further includes: after the step c, it further includes: evaluating the accuracy of the model with a test data set of the same structure and testing and verifying it.
  • a traffic classification system based on a deep neural network including:
  • Data set generation module used to extract features of the original network traffic, generate various types of network flow data, and mark the network flow data according to the network log to generate a data set for building a deep neural network; among them, the extracted The characteristics include the three-dimensional characteristics of forward flow, reverse flow, and transmission flow of each network flow;
  • CNN feature extraction module used to reconstruct the structure of the data set, and train the CNN network through the reconstructed data set.
  • the CNN network calculates the forward flow and reverse flow features in each network flow based on the extracted three-dimensional features. , The correlation coefficient matrix between forward flow and transmission flow characteristics, reverse flow and transmission flow characteristics, and output high-dimensional global convolution features;
  • LSTM prediction module used to input the global convolution features output by the CNN network into the LSTM network for training, and output traffic classification prediction results.
  • an electronic device including:
  • At least one processor At least one processor
  • a memory communicatively connected with the at least one processor; wherein,
  • the memory stores instructions executable by the one processor, and the instructions are executed by the at least one processor, so that the at least one processor can execute the following of the above-mentioned deep neural network-based traffic classification method: operating:
  • Step a Perform feature extraction on the original network traffic, generate various types of network flow data, and mark the network flow data according to the network log to generate a data set for building a deep neural network; where the extracted features include each Three-dimensional characteristics of forward flow, reverse flow, and transmission flow of a network flow;
  • Step b Restructure the data set structure, and train the CNN network through the reconstructed data set.
  • the CNN network calculates the forward flow and reverse flow features and forward flow in each network flow based on the extracted three-dimensional features. Correlation coefficient matrix between the characteristics of the transport stream, the reverse flow and the transport stream, and output high-dimensional global convolution features;
  • Step c Input the global convolution features output by the CNN network into the LSTM network for training, and output the traffic classification prediction result.
  • the beneficial effects produced by the embodiments of this application are: the methods, systems and electronic devices for traffic classification based on deep neural networks in the embodiments of this application propose a traffic classification scheme based on CNN+LSTM, which uses each item for the first time.
  • the forward flow, reverse flow, and transmission flow characteristics of the network flow are taken as global features.
  • you can fully understand the network behavior; at the same time, using the deep learning neural network algorithm to do traffic classification can automatically Convolution extracts high-dimensional features, continuously iterative feature learning, and automatically learns parameters until the learning rate does not change. As a result, good classification accuracy is achieved.
  • the present application can improve the accuracy and performance of network traffic classification.
  • FIG. 1 is a flowchart of a method for traffic classification based on a deep neural network according to an embodiment of the present application
  • FIG. 2 is a schematic structural diagram of a traffic classification system based on a deep neural network according to an embodiment of the present application
  • FIG. 3 is a schematic diagram of a hardware device structure of a method for traffic classification based on a deep neural network provided by an embodiment of the present application.
  • FIG. 1 is a flowchart of a method for traffic classification based on a deep neural network according to an embodiment of the present application.
  • the method for traffic classification based on a deep neural network in the embodiment of the present application includes the following steps:
  • Step 100 Collect raw network traffic (Raw Traffic), and obtain corresponding network logs;
  • step 100 collecting original network traffic specifically refers to collecting network traffic through a network data center or a simulated local area network environment.
  • monitor the network data center by setting the dedicated network monitoring software parameters, such as enabling the SNMP protocol to periodically poll the smart switching nodes that enable the SNMP service to obtain traffic statistics based on the device port.
  • Other protocols operate in the same way.
  • Step 200 Perform feature extraction of the original network traffic based on the network packet classification technology, generate various types of network flow data (Flow Data), and mark the network flow data according to the network log to generate a data set for building a deep neural network ;
  • Flow Data network flow data
  • the feature extraction of network traffic includes: packet feature ⁇ Size-packet, Interval-packet,... ⁇ , flow feature ⁇ Length-flow, Flow packet-per,... ⁇ , state connection feature ⁇ Flag-Cnt, Active,... ⁇ , etc., and extract the three-dimensional characteristics of each network flow ⁇ forward flow (client->server), reverse flow (server->client), transport flow (tcp, udp) ⁇ , and the three-dimensional characteristics of each network flow
  • the characteristics of forward flow, reverse flow, and transmission flow are both different and inherently related.
  • This application uses the correlation coefficient matrix of these three network flows as the input of the deep neural network, so as to have a deep understanding of the characteristics of network traffic Contact to improve classification accuracy.
  • the network flow data mark is specifically: by detecting the five fields ⁇ source IP, source Port, destination IP, destination Port, transport protocol (TCP, UDP) ⁇ in the network log and each network flow, if the network flow and the network log are If there is the same 5-tuple, the label of the network flow is marked as the corresponding network application or protocol in the network log.
  • Step 300 Perform preprocessing and normalization processing on the data set to obtain a marked network flow data set
  • Step 400 reconstruct the structure of the training data set, and train a Convolutional Neural Network (CNN) through the reconstructed training data set to obtain high-dimensional global convolution features;
  • CNN Convolutional Neural Network
  • step 400 the training process of the convolutional neural network specifically includes the following steps:
  • Step 401 Input the marked training data set into the convolutional neural network
  • Step 402 Based on the extracted three-dimensional features, respectively calculate the correlation coefficient matrix between the forward flow and reverse flow characteristics, the forward flow and the transmission flow characteristics, the reverse flow and the transmission flow characteristics in each network flow, and generate a three-dimensional Characteristic network flow data set structure.
  • each network flow can be roughly divided into 75 features, including 25 features for forward flow, 25 features for reverse flow, and 25 features for transmission flow. The correlation coefficient matrix between the two is calculated respectively.
  • Step 403 In order to adapt to the data input format of the convolutional neural network, transform the data set format to (None, 25, 25, 3); for example: advanced neural network Keras, if you use Theano and Caffe as the backend, use (sample Number, number of channels, row or height, column or width) The channel first method is called channels_first; if you use TensorFlow as the backend, use (sample number, row or height, column or Width, number of channels) The way after the channel is called channels_last.
  • the transformed data format (None, 25, 25, 3) can be regarded as a 25x25 color picture with 3 channels, which can better convolution operations to obtain comprehensive convolution features.
  • Step 404 Use the reconstructed training data set to train the convolutional neural network to obtain high-dimensional global convolution features
  • the convolutional neural network generally includes the following layers:
  • Each convolutional layer in CNN can be composed of several convolutional units, and the parameters of each convolutional unit are optimized by backpropagation algorithm.
  • the purpose of the convolution operation is to extract local features.
  • the first layer of convolution may only extract some low-level features such as edges, lines, and corners. With more network layers, more complex local features can be extracted.
  • the activation function (Activation function) can transform the features through nonlinear transformation, making it more suitable for reality and reducing over-fitting;
  • 2Pooling layer usually a large number of high-dimensional features are generated after convolution. These high-dimensional features are divided into several regions, and the maximum or average value of each region is taken to obtain a new smaller dimension feature;
  • 3Fully-Connected layer Convert all high-dimensional features into global features.
  • Step 500 Re-adjust the structure of the global convolution features output by the convolutional neural network and input them into the Long Short-Term Memory (LSTM) for training, and output the final traffic classification prediction results;
  • LSTM Long Short-Term Memory
  • the LSTM network is composed of different network units or memory blocks.
  • the LSTM unit generally outputs two states to the next LSTM unit, namely the unit state and the hidden state.
  • the memory block is responsible for memorizing events in each hidden state or previous time step. This memory method is generally implemented through three gate control mechanisms: input gate, forget gate and output gate.
  • this application uses the LSTM network to use sequence features as input for predictive classification, which can learn the relationship between features well and obtain high classification accuracy.
  • Step 600 Evaluate the accuracy of the model with a test data set of the same structure and test and verify it, so as to improve the classification accuracy and robustness of the model;
  • step 600 by verifying the model with the same structure of the test set, automatic convolution to obtain many high-dimensional features, and using the training deep neural model to obtain a higher classification recognition rate and accuracy.
  • FIG. 2 is a schematic structural diagram of a traffic classification system based on a deep neural network according to an embodiment of the present application.
  • the deep neural network-based traffic classification system of the embodiment of the present application includes a data acquisition module, a data set generation module, a data set processing module, a CNN feature extraction module, an LSTM prediction module, and a test module.
  • Data collection module used to collect raw network traffic (Raw Traffic) and obtain corresponding network logs; among them, collecting raw network traffic specifically refers to network traffic collection through a network data center or a simulated LAN environment.
  • Other protocols operate in the same way. Or set a specific network protocol in the simulated LAN environment, and let the corresponding network application service obtain network traffic data through the firewall.
  • In order to accurately mark network traffic when collecting network traffic, it is necessary to obtain corresponding network logs. These logs record in detail the interaction between network applications, the transmission load of network applications and servers, etc.
  • Data set generation module used to extract features of original network traffic based on network packet classification technology, generate various types of network flow data (Flow Data), and mark network flow data according to network logs to generate deep neural networks
  • the data set generation module includes:
  • a feature extraction unit used to extract network traffic characteristics; network traffic feature extraction includes: packet characteristics ⁇ Size-packet, Interval-packet,... ⁇ , flow characteristics ⁇ Length-flow, Flow packet-per,... ⁇ , state connection characteristics ⁇ Flag-Cnt, Active,... ⁇ , etc., and extract the ⁇ forward flow (client->server), reverse flow (server->client), transport flow (tcp, udp) ⁇ three-dimensional features of each network flow, The characteristics of the forward flow, reverse flow, and transmission flow of each network flow have both differences and internal connections.
  • This application uses the correlation coefficient matrices of these three network flows as the input of the deep neural network, so as to achieve a deeper level Understand the characteristics of network traffic and improve classification accuracy.
  • the network flow marking unit used to mark network flow data; by detecting the five fields ⁇ source IP, source Port, destination IP, destination Port, transport protocol (TCP, UDP) ⁇ in the network log and each network flow, If the network flow and the network log have the same 5-tuple, the label of the network flow is marked as the corresponding network application or protocol in the network log.
  • Data set processing module used to preprocess and normalize the data set to obtain a marked network flow data set
  • CNN feature extraction module used to reconstruct the structure of the training data set, and train a Convolutional Neural Network (CNN) through the reconstructed training data set to obtain high-dimensional global convolution features; the CNN feature extraction module specifically includes The following operations:
  • each network flow can be roughly divided into 75 features, including 25 features for forward flow, 25 features for reverse flow, and 25 features for transmission flow.
  • the correlation coefficient matrix between the two is calculated respectively.
  • the data set format is transformed to (None, 25, 25, 3); for example: advanced neural network Keras, if you use Theano and Caffe as the backend, use (number of samples) , Channel number, row or height, column or width)
  • the channel first method is called channels_first; if you use TensorFlow as the backend, use (sample number, row or height, column or width) , The number of channels)
  • the way after the channel is called channels_last.
  • the transformed data format (None, 25, 25, 3) can be regarded as a 25x25 color picture with 3 channels, which can better convolution operations to obtain comprehensive convolution features.
  • the convolutional neural network with the reconstructed training data set to obtain high-dimensional global convolutional features;
  • the convolutional neural network generally includes the following layers:
  • Each convolutional layer in CNN can be composed of several convolution units, and the parameters of each convolution unit are optimized by backpropagation algorithm.
  • the purpose of the convolution operation is to extract local features.
  • the first layer of convolution may only extract some low-level features such as edges, lines, and corners. With more network layers, more complex local features can be extracted.
  • the activation function (Activation function) can transform the features through nonlinear transformation, making it more suitable for reality and reducing over-fitting;
  • 2Pooling layer usually a large number of high-dimensional features are generated after convolution. These high-dimensional features are divided into several regions, and the maximum or average value of each region is taken to obtain a new smaller dimension feature;
  • 3Fully-Connected layer Convert all high-dimensional features into global features.
  • LSTM prediction module used to re-adjust the structure of the global convolutional features output by the convolutional neural network and input it into the Long Short-Term Memory (LSTM) for training, and output the final traffic classification prediction results; among them, LSTM
  • the network is composed of different network units or memory blocks.
  • the LSTM unit generally outputs two states to the next LSTM unit, namely the unit state and the hidden state.
  • the memory block is responsible for memorizing events in each hidden state or previous time step. This memory method is generally implemented through three gate control mechanisms: input gate, forget gate and output gate.
  • multi-dimensional sequence correlation flow (Corr-Flow Vector) vector features can be obtained; then the fully connected layer is connected, and softmax is used as the activation function to output the predicted probability matrix of each class, and finally the traffic classification prediction result is obtained .
  • this application uses the LSTM network to use sequence features as input for predictive classification, which can learn the relationship between features well and obtain high classification accuracy.
  • Test module used to evaluate the accuracy of the model and test and verify it with the test data set of the same structure to improve the classification accuracy and robustness of the model; by verifying the model with the test set of the same structure, automatic convolution can obtain many high-dimensional features , And training deep neural models can achieve higher classification recognition rate and accuracy.
  • FIG. 3 is a schematic diagram of a hardware device structure of a method for traffic classification based on a deep neural network provided by an embodiment of the present application.
  • the device includes one or more processors and memory. Taking a processor as an example, the device may also include: an input system and an output system.
  • the processor, the memory, the input system, and the output system may be connected by a bus or other methods.
  • the connection by a bus is taken as an example.
  • the memory can be used to store non-transitory software programs, non-transitory computer executable programs, and modules.
  • the processor executes various functional applications and data processing of the electronic device by running non-transitory software programs, instructions, and modules stored in the memory, that is, realizing the processing methods of the foregoing method embodiments.
  • the memory may include a program storage area and a data storage area, where the program storage area can store an operating system and an application program required by at least one function; the data storage area can store data and the like.
  • the memory may include a high-speed random access memory, and may also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state storage devices.
  • the memory may optionally include a memory remotely provided with respect to the processor, and these remote memories may be connected to the processing system through a network. Examples of the aforementioned networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
  • the input system can receive input digital or character information, and generate signal input.
  • the output system may include display devices such as a display screen.
  • the one or more modules are stored in the memory, and when executed by the one or more processors, the following operations of any of the foregoing method embodiments are performed:
  • Step a Perform feature extraction on the original network traffic, generate various types of network flow data, and mark the network flow data according to the network log to generate a data set for building a deep neural network; where the extracted features include each Three-dimensional characteristics of forward flow, reverse flow, and transmission flow of a network flow;
  • Step b Restructure the data set structure, and train the CNN network through the reconstructed data set.
  • the CNN network calculates the forward flow and reverse flow features and forward flow in each network flow based on the extracted three-dimensional features. Correlation coefficient matrix between the characteristics of the transport stream, the reverse flow and the transport stream, and output high-dimensional global convolution features;
  • Step c Input the global convolution feature output by the CNN network into the LSTM network for training, and output the traffic classification prediction result.
  • the embodiments of the present application provide a non-transitory (non-volatile) computer storage medium.
  • the computer storage medium stores computer-executable instructions, and the computer-executable instructions can perform the following operations:
  • Step a Perform feature extraction on the original network traffic, generate various types of network flow data, and mark the network flow data according to the network log to generate a data set for building a deep neural network; where the extracted features include each Three-dimensional characteristics of forward flow, reverse flow, and transmission flow of a network flow;
  • Step b Restructure the data set structure, and train the CNN network through the reconstructed data set.
  • the CNN network calculates the forward flow and reverse flow features and forward flow in each network flow based on the extracted three-dimensional features. Correlation coefficient matrix between the characteristics of the transport stream, the reverse flow and the transport stream, and output high-dimensional global convolution features;
  • Step c Input the global convolution feature output by the CNN network into the LSTM network for training, and output the traffic classification prediction result.
  • the embodiment of the present application provides a computer program product, the computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program includes program instructions, when the program instructions are executed by a computer To make the computer do the following:
  • Step a Perform feature extraction on the original network traffic, generate various types of network flow data, and mark the network flow data according to the network log to generate a data set for building a deep neural network; where the extracted features include each Three-dimensional characteristics of forward flow, reverse flow, and transmission flow of a network flow;
  • Step b Restructure the data set structure, and train the CNN network through the reconstructed data set.
  • the CNN network calculates the forward flow and reverse flow features and forward flow in each network flow based on the extracted three-dimensional features. Correlation coefficient matrix between the characteristics of the transport stream, the reverse flow and the transport stream, and output high-dimensional global convolution features;
  • Step c Input the global convolution feature output by the CNN network into the LSTM network for training, and output the traffic classification prediction result.
  • the method, system and electronic device for traffic classification based on deep neural networks in the embodiments of this application propose a traffic classification scheme based on CNN+LSTM, which uses the forward flow, reverse flow, and transport flow characteristics of each network flow as the global Feature, by analyzing and mining the association between these three, you can fully understand the network behavior; at the same time, using the deep learning neural network algorithm to do traffic classification, it can automatically convolution to extract high-dimensional features, iterative feature learning, automatic learning parameters, Until the learning rate does not change, the result is a good classification accuracy. Compared with the prior art, the present application can improve the accuracy and performance of network traffic classification.

Landscapes

  • Engineering & Computer Science (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Mathematical Physics (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Software Systems (AREA)
  • Evolutionary Computation (AREA)
  • General Health & Medical Sciences (AREA)
  • Molecular Biology (AREA)
  • Computational Linguistics (AREA)
  • General Engineering & Computer Science (AREA)
  • Biophysics (AREA)
  • Biomedical Technology (AREA)
  • Data Mining & Analysis (AREA)
  • Artificial Intelligence (AREA)
  • Algebra (AREA)
  • Mathematical Analysis (AREA)
  • Mathematical Optimization (AREA)
  • Probability & Statistics with Applications (AREA)
  • Pure & Applied Mathematics (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种基于深度神经网络的流量分类方法、系统及电子设备。所述方法包括：对原始网络流量进行特征提取，生成各种类型的网络流数据，并根据网络日志对网络流数据进行标记，生成用于构建深度神经网络的数据集；其中，所提取的特征包括每条网络流的前向流、反向流、传输流三维特征；重构数据集结构，并通过重构的数据集训练CNN网络，所述CNN网络基于提取的三维特征，分别计算每条网络流中的前向流和反向流特征、前向流和传输流特征、反向流和传输流特征之间的相关系数矩阵，输出高维度的全局卷积特征；将所述CNN网络输出的全局卷积特征输入LSTM网络进行训练，并输出流量分类预测结果。所述方法能够提高网络流量分类的精度和性能。

Description

一种基于深度神经网络的流量分类方法、系统及电子设备 技术领域
本申请属于网络数据分类技术领域，特别涉及一种基于深度神经网络的流量分类方法、系统及电子设备。
背景技术
在大数据时代，网络上每秒都会产生大批量的各种网络数据，这些数据之间的潜在交互行为继而会引发更多维的复杂数据，若企业能通过精准分析各类维度的网络数据，更好的全方位了解用户的网络行为，就可以为用户提供有针对性的服务，大幅提高企业的工作效率和用户的网络体验。
各大网络集群中心生成的网络流量数据量非常大且多且复杂，如何能快速安全的处理分析这些实时网络的流量数据，给企业的网络管理和服务带来了很大的压力。其中网络流量分类技术是识别网络应用和流量分类的过程，它是现代网络安全和资源管理系统中关键的一环。如何能精准的分类和识别这些网络流量，来提高网络安全等级和提供精准的网络服务，给客户提供更好的服务等仍是一大挑战。
目前，网络流量分类技术主要包括基于传统的网络流量分类和现阶段的基于机器学习的网络流量分类两大部分，其中：
(一)基于传统的网络流量分类技术包括基于端口的流量分类方法和基于负载的流量分类方法；
a)基于端口的流量分类方法：通过分析和提取一些使用固定网络端口的网络应用或者协议，其中一些端口号是在互联网号码分配机构(IANA)已经注册的。通过和IANA列表一一比较，就可以知道网络流量到底属于哪一个应用 或者哪一个网络协议，有很好的分类效果。该方法的弊端是不能处理拥有动态端口号的网络流量。
b)基于负载的流量分类方法：通过提取每条IP网络包的负载内容，包括网络传输协议、网络数据内容、传输包的字节大小等特征。不同的网络应用或者传输协议在上网的时候，是会产生不同的网络行为或者网络痕迹，该方法基于此网络特征可以进行高效的流量分类，但弊端是不能分析加密流量。
(二)基于机器学习的网络流量分类技术：主要包括基于监督学习的分类方法和基于无监督学习的分类方法，这两大类机器学习技术已经被广泛的应用于网络流量分类研究领域中，其分类流程如图1所示，一般分为四个步骤：数据预处理(Preprocessing)、训练学习阶段(Training)、模型评估(Evaluation)、预测结果(Prediction)。
a)基于监督学习的分类方法：从已经标记的训练数据中学习数据之间的潜在知识，并把这套知识进行强化训练，形成一个具有分类学习经验的模型，去预测新数据的标签。通过不断优化模型，来达到期望的输出效果。例如，王斌锋等人发明一种基于统计特征的有噪网络流量分类建模方法，它包括：步骤1、网络数据采集处理，从网络流量监测站实时提取网络流量数据，并对网络流量数据进行预处理；步骤2、建立网络流量噪声判断模型并清除网络流量数据中的噪声；步骤3、建立网络流量噪声容忍模型；步骤4、根据步骤2和步骤3所述的网络流量噪声判断模型和网络流量噪声容忍模型，建立鲁棒的分类模型；步骤5、采用随机森林的分类方法，把在线网络流量数据作为测试集，利用鲁棒的分类模型进行分类。
B)基于无监督学习的分类方法：从未标记(未知)的训练数据中学习数据之间的分布或者数据之间的关系，不断训练数据，可以得到一个可以分类未知 数据类型的模型。例如，张玉等人发明了一种基于K_means和KNN融合算法的网络流量分类方法。他们的方法框架是针对每个应用协议构建一个二分类器，由决策规则将所有分类器的输出整合为最终输出。算法上也融合了无监督的K_means算法和有监督的KNN算法，此外，该方法还提出了基于K_means迭代的特征选择算法，目的是选出高分离度的特征，以节省时间、空间和提高分类效果。
综上所述，现有的基于机器学习的网络流量分类技术虽然较传统的网络流量分类方法有较好的分类效果，但也存在不少弊端，主要包括：手动提取特征，需要花费大量的人力物力；现有的流量特征密度较小，不能深层次的利用网络应用和协议流量特征；现有的网络流量分类模型鲁棒性不是很好，只要网络流量的数据环境变化，就要重新训练模型学习其特征，得到的分类效果不是很好。
发明内容
本申请提供了一种基于深度神经网络的流量分类方法、系统及电子设备，旨在至少在一定程度上解决现有技术中的上述技术问题之一。
为了解决上述问题，本申请提供了如下技术方案：
一种基于深度神经网络的流量分类方法，包括以下步骤：
步骤a：对原始网络流量进行特征提取，生成各种类型的网络流数据，并根据网络日志对网络流数据进行标记，生成用于构建深度神经网络的数据集；其中，所提取的特征包括每条网络流的前向流、反向流、传输流三维特征；
步骤b：重构数据集结构，并通过重构的数据集训练CNN网络，所述CNN网络基于提取的三维特征，分别计算每条网络流中的前向流和反向流特征、前向流和传输流特征、反向流和传输流特征之间的相关系数矩阵，输出高维度的全局卷积特征；
步骤c：将所述CNN网络输出的全局卷积特征输入LSTM网络进行训练，并输出流量分类预测结果。
本申请实施例采取的技术方案还包括：所述步骤a还包括：采集原始网络流量，并获取相应的网络日志；其中，所述原始网络流量通过网络数据中心或者模拟局域网环境进行采集，所述网络日志内容包括网络应用间的交互行为、网络应用和服务端的传输负载。
本申请实施例采取的技术方案还包括：在所述步骤a中，所述对原始网络流量进行特征提取，生成各种类型的网络流数据，并根据网络日志对网络流数据进行标记具体包括：
步骤a1：将拥有相同的五元组{源IP,源Port,目的IP，目的Port,传输协议(TCP,UDP)}的网络包{packet_1,packet_2,…,packet_n}归并为对应的网络流Flow_i＝{packet_1,packet_2,…,packet_n}(i＝1,2,…,n)；
步骤a2：提取包特征{Size-packet,Interval-packet,…}、流特征{Length-flow,Flow packet-per,…}、状态连接特征{Flag-Cnt,Active,…}，以及每条网络流的{前向流(client->server)，反向流(server->client)，传输流(tcp,udp)}三维特征；
步骤a3：检测网络日志和每条网络流中的{源IP,源Port,目的IP，目的Port,传输协议(TCP,UDP)}五个字段，如果网络流与网络日志中有相同的五元组，则将该条网络流的标签标记为网络日志中对应的网络应用或者协议。
本申请实施例采取的技术方案还包括：所述步骤a还包括：对数据集进行预处理及归一化处理。
本申请实施例采取的技术方案还包括：在所述步骤b中，所述卷积神经网络的训练过程具体包括：
步骤b1：将标记好的数据集输入卷积神经网络中；
步骤b2：基于提取的三维特征，分别计算每条网络流中的前向流和反向流特征、前向流和传输流特征、反向流和传输流特征之间的相关系数矩阵，生成三维特征的网络流数据集结构；
步骤b3：为了适应卷积神经网的数据输入格式，将数据集格式变换为(None,25,25,3)；其中，变换后的数据格式(None,25,25,3)可以看成是25x25的彩色图片3通道；
步骤b4：用变换后的数据集训练卷积神经网络，得到高维度的全局卷积特征。
本申请实施例采取的技术方案还包括：在所述步骤b中，所述卷积神经网络包括卷积层、池化层和全连接层；所述卷积层用于提取局部特性；所述池化层用于将卷积之后产生的高维度特征分成几个区域，取每个区域的最大值或者平均值，得到新的较小维特征；所述全连接层用于将所有高维的特征转换成全局特征。
本申请实施例采取的技术方案还包括：在所述步骤c中，经过LSTM网络训练后，得到多维的序列相关流(Corr-Flow Vector)向量特征；然后连接全连接层，并用softmax做激活函数，输出预测的每个类的概率矩阵，最终得到流量分类预测结果。
本申请实施例采取的技术方案还包括：所述步骤c后还包括：用相同结构的测试数据集评估模型的精确度并测试验证。
本申请实施例采取的另一技术方案为：一种基于深度神经网络的流量分类系统，包括：
数据集生成模块：用于对原始网络流量进行特征提取，生成各种类型的网 络流数据，并根据网络日志对网络流数据进行标记，生成用于构建深度神经网络的数据集；其中，所提取的特征包括每条网络流的前向流、反向流、传输流三维特征；
CNN特征提取模块：用于重构数据集结构，并通过重构的数据集训练CNN网络，所述CNN网络基于提取的三维特征，分别计算每条网络流中的前向流和反向流特征、前向流和传输流特征、反向流和传输流特征之间的相关系数矩阵，输出高维度的全局卷积特征；
LSTM预测模块：用于将所述CNN网络输出的全局卷积特征输入LSTM网络进行训练，并输出流量分类预测结果。
本申请实施例采取的又一技术方案为：一种电子设备，包括：
至少一个处理器；以及
与所述至少一个处理器通信连接的存储器；其中，
所述存储器存储有可被所述一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行上述的基于深度神经网络的流量分类方法的以下操作：
步骤a：对原始网络流量进行特征提取，生成各种类型的网络流数据，并根据网络日志对网络流数据进行标记，生成用于构建深度神经网络的数据集；其中，所提取的特征包括每条网络流的前向流、反向流、传输流三维特征；
步骤b：重构数据集结构，并通过重构的数据集训练CNN网络，所述CNN网络基于提取的三维特征，分别计算每条网络流中的前向流和反向流特征、前向流和传输流特征、反向流和传输流特征之间的相关系数矩阵，输出高维度的全局卷积特征；
步骤c：将所述CNN网络输出的全局卷积特征输入LSTM网络进行训练， 并输出流量分类预测结果。
相对于现有技术，本申请实施例产生的有益效果在于：本申请实施例的基于深度神经网络的流量分类方法、系统及电子设备提出基于CNN+LSTM的流量分类方案，该方案首次利用每条网络流的前向流、反向流、传输流特征作为全局特征，通过分析挖掘这三者之间的关联，可以充分的了解网络行为；同时，使用深度学习神经网络算法做流量分类，可以自动卷积提取高维特征，不断迭代特征学习，自动学习参数，直到学习率不在发生变化，结果取得了很好的分类精度。相比现有技术，本申请能够提高网络流量分类的精度和性能。
附图说明
图1是本申请实施例的基于深度神经网络的流量分类方法的流程图；
图2是本申请实施例的基于深度神经网络的流量分类系统的结构示意图；
图3是本申请实施例提供的基于深度神经网络的流量分类方法的硬件设备结构示意图。
具体实施方式
为了使本申请的目的、技术方案及优点更加清楚明白，以下结合附图及实施例，对本申请进行进一步详细说明。应当理解，此处所描述的具体实施例仅用以解释本申请，并不用于限定本申请。
请参阅图1，是本申请实施例的基于深度神经网络的流量分类方法的流程图。本申请实施例的基于深度神经网络的流量分类方法包括以下步骤：
步骤100：采集原始网络流量(Raw Traffic)，并获取相应的网络日志；
步骤100中，采集原始网络流量具体为通过网络数据中心或者模拟局域网环境进行网络流量采集。首先通过设置专用网络监控软件参数监控网络数据中 心，例如开启SNMP协议定时轮询开启SNMP服务的智能交换节点，以获得基于设备端口的流量统计，其他协议同理操作。或者在模拟局域网环境中设置特定的网络协议，让对应的网络应用服务通过防火墙获取网络流量数据。为了准确的标记网络流量，在采集网络流量时，必须要获取相应的网络日志，这些日志详细的记载着网络应用间的交互行为、网络应用和服务端的传输负载等。
步骤200：基于网络包分类技术对原始网络流量进行特征提取，生成各种类型的网络流数据(Flow Data)，并根据网络日志对网络流数据进行标记，生成用于构建深度神经网络的数据集；
步骤200中，网络包分类技术即将拥有相同的五元组{源IP,源Port,目的IP，目的Port,传输协议(TCP,UDP)}的网络包{packet_1,packet_2,…,packet_n}归并为对应的网络流Flow_i＝{packet_1,packet_2,…,packet_n}(i＝1,2,…,n)；由于传输协议TCP和UDP的连接时间都是有生命周期的，因此随着时间，这些相同的网络包会产生很多的网络流{flow1,flow2,…}。
本申请实施例中，网络流量的特征提取包括：包特征{Size-packet,Interval-packet,…}、流特征{Length-flow,Flow packet-per,…}、状态连接特征{Flag-Cnt,Active,…}等，并提取每条网络流的{前向流(client->server)，反向流(server->client)，传输流(tcp,udp)}三维特征，每条网络流的前向流、反向流、传输流的特征之间既有区别也有内在联系，本申请通过将这三种网络流的相关系数矩阵作为深度神经网络的输入，从而能够深层次了解网络流量的特征联系，提高分类精度。
网络流数据标记具体为：通过检测网络日志和每条网络流中的{源IP,源Port,目的IP，目的Port,传输协议(TCP,UDP)}五个字段，如果网络流与网络日志中有相同的五元组，则将该条网络流的标签标记为网络日志中对应的网络 应用或者协议。
步骤300：对数据集进行预处理及归一化处理，得到带有标记的网络流数据集；
步骤400：重构训练数据集结构，并通过重构的训练数据集训练卷积神经网络(Convolutional Neural Network,CNN)，得到高维度的全局卷积特征；
步骤400中，卷积神经网络的训练过程具体包括以下步骤：
步骤401：将标记好的训练数据集输入卷积神经网络中；
步骤402：基于提取的三维特征，分别计算每条网络流中的前向流和反向流特征、前向流和传输流特征、反向流和传输流特征之间的相关系数矩阵，生成三维特征的网络流数据集结构。例如：每条网络流大致可以分为75个特征，其中前向流25个特征，反向流25个特征，传输流25个特征，分别计算二者之间的相关系数矩阵。
步骤403：为了适应卷积神经网的数据输入格式，将数据集格式变换为(None,25,25,3)；例如：高级神经网络Keras，如果使用Theano和Caffe做后端，则使用(样本数，通道数，行或称为高，列或称为宽)通道在前的方式，称为channels_first；如果使用TensorFlow做后端，则使用(样本数，行或称为高，列或称为宽，通道数)通道在后的方式，称为channels_last。变换后的数据格式(None,25,25,3)可以看成是25x25的彩色图片3通道，能更好的卷积操作得到全面的卷积特征。
步骤404：用重构的训练数据集训练卷积神经网络，得到高维度的全局卷积特征；
步骤404中，卷积神经网络一般包括以下几种层：
①卷积层(Convolutional layer)；CNN中每层卷积层可由若干卷积单元组 成，每个卷积单元的参数通过反向传播算法优化得到。卷积运算的目的是提取局部特性，第一层卷积层可能只能提取一些边缘、线条和角等层级的低级特征，拥有更多的网络层则能提取到更复杂的局部特征。其中的激活函数(Activation function)可以将特征经过非线性变换，使得更加贴合实际，减少过拟合；
②池化层(Pooling layer)；通常在卷积之后产生大量的高维度特征，将这些高维度特征分成几个区域，取每个区域的最大值或者平均值等，可以得到新的较小维特征；
③全连接层(Fully-Connected layer)；将所有高维的特征转换成全局特征。
基于上述操作，通过CNN网络不断迭代提取局部特征，可以很好的抽象提取出网络流的高维特征。
步骤500：将卷积神经网络输出的全局卷积特征重新调整结构后输入长短期记忆网络(LSTM，Long Short-Term Memory)进行训练，并输出最终的流量分类预测结果；
步骤500中，LSTM网络由不同的网络单元或者记忆块组成。LSTM单元一般会输出两种状态到下一个LSTM单元，即单元状态和隐藏状态。记忆块负责记忆各个隐藏状态或前面时间步的事件，这种记忆方式一般是通过输入门、遗忘门和输出门三种门控机制实现的。
经过LSTM网络训练后，可以得到多维的序列相关流(Corr-Flow Vector)向量特征；然后连接全连接层，并用softmax做激活函数，输出预测的每个类的概率矩阵，最终得到流量分类预测结果。
上述中，本申请用LSTM网络以序列特征为输入做预测分类，可以很好的学习特征之间的关系，得到很高的分类精度。
步骤600：用相同结构的测试数据集评估模型的精确度并测试验证，提高 模型的分类精度和鲁棒性；
步骤600中，通过用同样结构的测试集验证模型，自动卷积得到很多的高维特征，并用训练深度神经模型可以取得较高的分类识别率和准确率。
请参阅图2，是本申请实施例的基于深度神经网络的流量分类系统的结构示意图。本申请实施例的基于深度神经网络的流量分类系统包括数据采集模块、数据集生成模块、数据集处理模块、CNN特征提取模块、LSTM预测模块和测试模块。
数据采集模块：用于采集原始网络流量(Raw Traffic)，并获取相应的网络日志；其中，采集原始网络流量具体为通过网络数据中心或者模拟局域网环境进行网络流量采集。首先通过设置专用网络监控软件参数监控网络数据中心，例如开启SNMP协议定时轮询开启SNMP服务的智能交换节点，以获得基于设备端口的流量统计，其他协议同理操作。或者在模拟局域网环境中设置特定的网络协议，让对应的网络应用服务通过防火墙获取网络流量数据。为了准确的标记网络流量，在采集网络流量时，必须要获取相应的网络日志，这些日志详细的记载着网络应用间的交互行为、网络应用和服务端的传输负载等。
数据集生成模块：用于基于网络包分类技术对原始网络流量进行特征提取，生成各种类型的网络流数据(Flow Data)，并根据网络日志对网络流数据进行标记，生成用于构建深度神经网络的数据集；其中，网络包分类技术即将拥有相同的五元组{源IP,源Port,目的IP，目的Port,传输协议(TCP,UDP)}的网络包{packet_1,packet_2,…,packet_n}归并为对应的网络流Flow_i＝{packet_1,packet_2,…,packet_n}(i＝1,2,…,n)；由于传输协议TCP和UDP的连接时间都是有生命周期的，因此随着时间，这些相同的网络包会产生很多的网络流{flow1,flow2,…}。
具体的，数据集生成模块包括：
用于提取网络流量特征的特征提取单元；网络流量的特征提取包括：包特征{Size-packet,Interval-packet,…}、流特征{Length-flow,Flow packet-per,…}、状态连接特征{Flag-Cnt,Active,…}等，并提取每条网络流的{前向流(client->server)，反向流(server->client)，传输流(tcp,udp)}三维特征，每条网络流的前向流、反向流、传输流的特征之间既有区别也有内在联系，本申请通过将这三种网络流的相关系数矩阵作为深度神经网络的输入，从而能够深层次了解网络流量的特征联系，提高分类精度。
用于对网络流数据进行标记的网络流标记单元；通过检测网络日志和每条网络流中的{源IP,源Port,目的IP，目的Port,传输协议(TCP,UDP)}五个字段，如果网络流与网络日志中有相同的五元组，则将该条网络流的标签标记为网络日志中对应的网络应用或者协议。
数据集处理模块：用于对数据集进行预处理及归一化处理，得到带有标记的网络流数据集；
CNN特征提取模块：用于重构训练数据集结构，并通过重构的训练数据集训练卷积神经网络(Convolutional Neural Network,CNN)，得到高维度的全局卷积特征；CNN特征提取模块具体包括以下操作：
1)将标记好的训练数据集输入卷积神经网络中；
2)基于提取的三维特征，分别计算每条网络流中的前向流和反向流特征、前向流和传输流特征、反向流和传输流特征之间的相关系数矩阵，生成三维特征的网络流数据集结构。例如：每条网络流大致可以分为75个特征，其中前向流25个特征，反向流25个特征，传输流25个特征，分别计算二者之间的相关系数矩阵。
3)为了适应卷积神经网的数据输入格式，将数据集格式变换为(None,25,25,3)；例如：高级神经网络Keras，如果使用Theano和Caffe做后端，则使用(样本数，通道数，行或称为高，列或称为宽)通道在前的方式，称为channels_first；如果使用TensorFlow做后端，则使用(样本数，行或称为高，列或称为宽，通道数)通道在后的方式，称为channels_last。变换后的数据格式(None,25,25,3)可以看成是25x25的彩色图片3通道，能更好的卷积操作得到全面的卷积特征。
4)用重构的训练数据集训练卷积神经网络，得到高维度的全局卷积特征；卷积神经网络一般包括以下几种层：
①卷积层(Convolutional layer)；CNN中每层卷积层可由若干卷积单元组成，每个卷积单元的参数通过反向传播算法优化得到。卷积运算的目的是提取局部特性，第一层卷积层可能只能提取一些边缘、线条和角等层级的低级特征，拥有更多的网络层则能提取到更复杂的局部特征。其中的激活函数(Activation function)可以将特征经过非线性变换，使得更加贴合实际，减少过拟合；
②池化层(Pooling layer)；通常在卷积之后产生大量的高维度特征，将这些高维度特征分成几个区域，取每个区域的最大值或者平均值等，可以得到新的较小维特征；
③全连接层(Fully-Connected layer)；将所有高维的特征转换成全局特征。
基于上述操作，通过CNN网络不断迭代提取局部特征，可以很好的抽象提取出网络流的高维特征。
LSTM预测模块：用于将卷积神经网络输出的全局卷积特征重新调整结构后输入长短期记忆网络(LSTM，Long Short-Term Memory)进行训练，并输出最终的流量分类预测结果；其中，LSTM网络由不同的网络单元或者记忆 块组成。LSTM单元一般会输出两种状态到下一个LSTM单元，即单元状态和隐藏状态。记忆块负责记忆各个隐藏状态或前面时间步的事件，这种记忆方式一般是通过输入门、遗忘门和输出门三种门控机制实现的。
经过LSTM网络训练后，可以得到多维的序列相关流(Corr-Flow Vector)向量特征；然后连接全连接层，并用softmax做激活函数，输出预测的每个类的概率矩阵，最终得到流量分类预测结果。
上述中，本申请用LSTM网络以序列特征为输入做预测分类，可以很好的学习特征之间的关系，得到很高的分类精度。
测试模块：用于使用相同结构的测试数据集评估模型的精确度并测试验证，提高模型的分类精度和鲁棒性；通过用同样结构的测试集验证模型，自动卷积得到很多的高维特征，并用训练深度神经模型可以取得较高的分类识别率和准确率。
图3是本申请实施例提供的基于深度神经网络的流量分类方法的硬件设备结构示意图。如图3所示，该设备包括一个或多个处理器以及存储器。以一个处理器为例，该设备还可以包括：输入系统和输出系统。
处理器、存储器、输入系统和输出系统可以通过总线或者其他方式连接，图3中以通过总线连接为例。
存储器作为一种非暂态计算机可读存储介质，可用于存储非暂态软件程序、非暂态计算机可执行程序以及模块。处理器通过运行存储在存储器中的非暂态软件程序、指令以及模块，从而执行电子设备的各种功能应用以及数据处理，即实现上述方法实施例的处理方法。
存储器可以包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需要的应用程序；存储数据区可存储数据等。此外，存储器可以包括高速随机存取存储器，还可以包括非暂态存储器，例如至少一个 磁盘存储器件、闪存器件、或其他非暂态固态存储器件。在一些实施例中，存储器可选包括相对于处理器远程设置的存储器，这些远程存储器可以通过网络连接至处理系统。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
输入系统可接收输入的数字或字符信息，以及产生信号输入。输出系统可包括显示屏等显示设备。
所述一个或者多个模块存储在所述存储器中，当被所述一个或者多个处理器执行时，执行上述任一方法实施例的以下操作：
步骤a：对原始网络流量进行特征提取，生成各种类型的网络流数据，并根据网络日志对网络流数据进行标记，生成用于构建深度神经网络的数据集；其中，所提取的特征包括每条网络流的前向流、反向流、传输流三维特征；
步骤b：重构数据集结构，并通过重构的数据集训练CNN网络，所述CNN网络基于提取的三维特征，分别计算每条网络流中的前向流和反向流特征、前向流和传输流特征、反向流和传输流特征之间的相关系数矩阵，输出高维度的全局卷积特征；
步骤c：将所述CNN网络输出的全局卷积特征输入LSTM网络进行训练，并输出流量分类预测结果。
上述产品可执行本申请实施例所提供的方法，具备执行方法相应的功能模块和有益效果。未在本实施例中详尽描述的技术细节，可参见本申请实施例提供的方法。
本申请实施例提供了一种非暂态(非易失性)计算机存储介质，所述计算机存储介质存储有计算机可执行指令，该计算机可执行指令可执行以下操作：
步骤a：对原始网络流量进行特征提取，生成各种类型的网络流数据，并 根据网络日志对网络流数据进行标记，生成用于构建深度神经网络的数据集；其中，所提取的特征包括每条网络流的前向流、反向流、传输流三维特征；
步骤b：重构数据集结构，并通过重构的数据集训练CNN网络，所述CNN网络基于提取的三维特征，分别计算每条网络流中的前向流和反向流特征、前向流和传输流特征、反向流和传输流特征之间的相关系数矩阵，输出高维度的全局卷积特征；
步骤c：将所述CNN网络输出的全局卷积特征输入LSTM网络进行训练，并输出流量分类预测结果。
本申请实施例提供了一种计算机程序产品，所述计算机程序产品包括存储在非暂态计算机可读存储介质上的计算机程序，所述计算机程序包括程序指令，当所述程序指令被计算机执行时，使所述计算机执行以下操作：
步骤a：对原始网络流量进行特征提取，生成各种类型的网络流数据，并根据网络日志对网络流数据进行标记，生成用于构建深度神经网络的数据集；其中，所提取的特征包括每条网络流的前向流、反向流、传输流三维特征；
步骤b：重构数据集结构，并通过重构的数据集训练CNN网络，所述CNN网络基于提取的三维特征，分别计算每条网络流中的前向流和反向流特征、前向流和传输流特征、反向流和传输流特征之间的相关系数矩阵，输出高维度的全局卷积特征；
步骤c：将所述CNN网络输出的全局卷积特征输入LSTM网络进行训练，并输出流量分类预测结果。
本申请实施例的基于深度神经网络的流量分类方法、系统及电子设备提出基于CNN+LSTM的流量分类方案，该方案首次利用每条网络流的前向流、反向流、传输流特征作为全局特征，通过分析挖掘这三者之间的关联，可以充分 的了解网络行为；同时，使用深度学习神经网络算法做流量分类，可以自动卷积提取高维特征，不断迭代特征学习，自动学习参数，直到学习率不在发生变化，结果取得了很好的分类精度。相比现有技术，本申请能够提高网络流量分类的精度和性能。
以上所述仅是本发明的优选实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本发明原理的前提下，还可以做出若干改进和润饰，这些改进和润饰也应视为本发明的保护范围。

Claims (10)

  1. 一种基于深度神经网络的流量分类方法，其特征在于，包括以下步骤：
    步骤a：对原始网络流量进行特征提取，生成各种类型的网络流数据，并根据网络日志对网络流数据进行标记，生成用于构建深度神经网络的数据集；其中，所提取的特征包括每条网络流的前向流、反向流、传输流三维特征；
    步骤b：重构数据集结构，并通过重构的数据集训练CNN网络，所述CNN网络基于提取的三维特征，分别计算每条网络流中的前向流和反向流特征、前向流和传输流特征、反向流和传输流特征之间的相关系数矩阵，输出高维度的全局卷积特征；
    步骤c：将所述CNN网络输出的全局卷积特征输入LSTM网络进行训练，并输出流量分类预测结果。
  2. 根据权利要求1所述的基于深度神经网络的流量分类方法，其特征在于，所述步骤a还包括：采集原始网络流量，并获取相应的网络日志；其中，所述原始网络流量通过网络数据中心或者模拟局域网环境进行采集，所述网络日志内容包括网络应用间的交互行为、网络应用和服务端的传输负载。
  3. 根据权利要求2所述的基于深度神经网络的流量分类方法，其特征在于，在所述步骤a中，所述对原始网络流量进行特征提取，生成各种类型的网络流数据，并根据网络日志对网络流数据进行标记具体包括：
    步骤a1：将拥有相同的五元组{源IP,源Port,目的IP，目的Port,传输协议(TCP,UDP)}的网络包{packet_1,packet_2,…,packet_n}归并为对应的网络流Flow_i＝{packet_1,packet_2,…,packet_n}(i＝1,2,…,n)；
    步骤a2：提取包特征{Size-packet,Interval-packet,…}、流特征{Length-flow,Flow packet-per,…}、状态连接特征{Flag-Cnt,Active,…}，以及每条网络流的{前向流(client->server)，反向流(server->client)，传输流(tcp,udp)}三维特征；
    步骤a3：检测网络日志和每条网络流中的{源IP,源Port,目的IP，目的Port,传输协议(TCP,UDP)}五个字段，如果网络流与网络日志中有相同的五元组，则将该条网络流的标签标记为网络日志中对应的网络应用或者协议。
  4. 根据权利要求1所述的基于深度神经网络的流量分类方法，其特征在于，所述步骤a还包括：对数据集进行预处理及归一化处理。
  5. 根据权利要求1至4任一项所述的基于深度神经网络的流量分类方法，其特征在于，在所述步骤b中，所述卷积神经网络的训练过程具体包括：
    步骤b1：将标记好的数据集输入卷积神经网络中；
    步骤b2：基于提取的三维特征，分别计算每条网络流中的前向流和反向流特征、前向流和传输流特征、反向流和传输流特征之间的相关系数矩阵，生成三维特征的网络流数据集结构；
    步骤b3：为了适应卷积神经网的数据输入格式，将数据集格式变换为(None,25,25,3)；其中，变换后的数据格式(None,25,25,3)可以看成是25x25的彩色图片3通道；
    步骤b4：用变换后的数据集训练卷积神经网络，得到高维度的全局卷积特征。
  6. 根据权利要求5所述的基于深度神经网络的流量分类方法，其特征在于，在所述步骤b中，所述卷积神经网络包括卷积层、池化层和全连接层；所述卷积层用于提取局部特性；所述池化层用于将卷积之后产生的高维度特征分成几个 区域，取每个区域的最大值或者平均值，得到新的较小维特征；所述全连接层用于将所有高维的特征转换成全局特征。
  7. 根据权利要求5所述的基于深度神经网络的流量分类方法，其特征在于，在所述步骤c中，经过LSTM网络训练后，得到多维的序列相关流(Corr-Flow Vector)向量特征；然后连接全连接层，并用softmax做激活函数，输出预测的每个类的概率矩阵，最终得到流量分类预测结果。
  8. 根据权利要求7所述的基于深度神经网络的流量分类方法，其特征在于，所述步骤c后还包括：用相同结构的测试数据集评估模型的精确度并测试验证。
  9. 一种基于深度神经网络的流量分类系统，其特征在于，包括：
    数据集生成模块：用于对原始网络流量进行特征提取，生成各种类型的网络流数据，并根据网络日志对网络流数据进行标记，生成用于构建深度神经网络的数据集；其中，所提取的特征包括每条网络流的前向流、反向流、传输流三维特征；
    CNN特征提取模块：用于重构数据集结构，并通过重构的数据集训练CNN网络，所述CNN网络基于提取的三维特征，分别计算每条网络流中的前向流和反向流特征、前向流和传输流特征、反向流和传输流特征之间的相关系数矩阵，输出高维度的全局卷积特征；
    LSTM预测模块：用于将所述CNN网络输出的全局卷积特征输入LSTM网络进行训练，并输出流量分类预测结果。
  10. 一种电子设备，包括：
    至少一个处理器；以及
    与所述至少一个处理器通信连接的存储器；其中，
    所述存储器存储有可被所述一个处理器执行的指令，所述指令被所述至少一 个处理器执行，以使所述至少一个处理器能够执行上述1至8任一项所述的基于深度神经网络的流量分类方法的以下操作：
    步骤a：对原始网络流量进行特征提取，生成各种类型的网络流数据，并根据网络日志对网络流数据进行标记，生成用于构建深度神经网络的数据集；其中，所提取的特征包括每条网络流的前向流、反向流、传输流三维特征；
    步骤b：重构数据集结构，并通过重构的数据集训练CNN网络，所述CNN网络基于提取的三维特征，分别计算每条网络流中的前向流和反向流特征、前向流和传输流特征、反向流和传输流特征之间的相关系数矩阵，输出高维度的全局卷积特征；
    步骤c：将所述CNN网络输出的全局卷积特征输入LSTM网络进行训练，并输出流量分类预测结果。
PCT/CN2019/124267 2019-11-25 2019-12-10 一种基于深度神经网络的流量分类方法、系统及电子设备 WO2021103135A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201911164170.2A CN110896381B (zh) 2019-11-25 2019-11-25 一种基于深度神经网络的流量分类方法、系统及电子设备
CN201911164170.2 2019-11-25

Publications (1)

Publication Number Publication Date
WO2021103135A1 true WO2021103135A1 (zh) 2021-06-03

Family

ID=69786801

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/124267 WO2021103135A1 (zh) 2019-11-25 2019-12-10 一种基于深度神经网络的流量分类方法、系统及电子设备

Country Status (2)

Country Link
CN (1) CN110896381B (zh)
WO (1) WO2021103135A1 (zh)

Cited By (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113408202A (zh) * 2021-06-18 2021-09-17 国网湖南省电力有限公司 面向变电站核心工控业务的流量基线模型构造方法
CN113949653A (zh) * 2021-10-18 2022-01-18 中铁二院工程集团有限责任公司 一种基于深度学习的加密协议识别方法及系统
CN114338853A (zh) * 2021-12-31 2022-04-12 西南民族大学 一种工业互联网下的区块链流量监检测方法
CN114338437A (zh) * 2022-01-13 2022-04-12 北京邮电大学 网络流量分类方法、装置、电子设备及存储介质
CN114358118A (zh) * 2021-11-29 2022-04-15 南京邮电大学 一种基于跨模态特征融合的多任务加密网络流量分类方法
CN114520838A (zh) * 2022-01-11 2022-05-20 北京交通大学 一种基于k近邻的自定义协议应用层的网络报文匹配方法
CN114679310A (zh) * 2022-03-22 2022-06-28 安徽赛福贝特信息技术有限公司 一种网络信息安全检测方法
CN114793197A (zh) * 2022-03-29 2022-07-26 广州杰赛科技股份有限公司 基于nfv的网络资源配置方法、装置、设备及存储介质
CN114818933A (zh) * 2021-12-23 2022-07-29 金数信息科技(苏州)有限公司 一种基于Epsilon贪心算法监测人工流量作弊的方法及装置
CN114844840A (zh) * 2022-04-26 2022-08-02 哈尔滨工业大学 一种基于计算似然比的分布外网络流量数据检测方法
CN115277888A (zh) * 2022-09-26 2022-11-01 中国电子科技集团公司第三十研究所 一种移动应用加密协议报文类型解析方法及系统
CN115297016A (zh) * 2022-05-07 2022-11-04 国网江苏省电力有限公司淮安供电分公司 一种基于深度学习的电力网络活跃度评价和预测方法
WO2023016159A1 (zh) * 2021-08-12 2023-02-16 北京邮电大学 智慧城市网络流量预测方法及系统
CN115712614A (zh) * 2022-11-07 2023-02-24 航科广软(广州)数字科技有限公司 基于数据传输流控制的信息处理方法及系统
WO2023040962A1 (zh) * 2021-09-18 2023-03-23 深圳比特微电子科技有限公司 参数配置模型的训练方法、参数配置方法和参数配置设备
CN116029219A (zh) * 2023-02-27 2023-04-28 中国空气动力研究与发展中心计算空气动力研究所 一种飞行器气动热预测方法、装置、设备及存储介质
CN116647877A (zh) * 2023-06-12 2023-08-25 广州爱浦路网络技术有限公司 一种基于图卷积模型的流量类别验证方法和系统
CN116708313A (zh) * 2023-08-08 2023-09-05 中国电信股份有限公司 流量检测方法、流量检测装置、存储介质和电子设备
CN117463506A (zh) * 2023-12-26 2024-01-30 浙江佳环电子有限公司 自适应恒流恒压控制高压电源

Families Citing this family (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111565311B (zh) * 2020-04-29 2022-02-25 杭州迪普科技股份有限公司 网络流量特征生成方法及装置
CN111885213A (zh) * 2020-06-09 2020-11-03 中国科学院信息工程研究所 一种基于门控卷积变分自编码器的IPv6地址发现方法和装置
CN111817981A (zh) * 2020-07-01 2020-10-23 黄东 一种基于深度学习的网络流量分类方法
CN111935134A (zh) * 2020-08-06 2020-11-13 中国交通通信信息中心 一种复杂网络安全风险监测方法和系统
CN112163594B (zh) * 2020-08-28 2022-07-26 南京邮电大学 一种网络加密流量识别方法及装置
CN112153045B (zh) * 2020-09-24 2023-03-28 中国人民解放军战略支援部队信息工程大学 一种私有协议的加密字段的识别方法及系统
CN112261063A (zh) * 2020-11-09 2021-01-22 北京理工大学 结合深度分层网络的网络恶意流量检测方法
CN112671600A (zh) * 2020-12-09 2021-04-16 中国科学院深圳先进技术研究院 网络流的特征提取方法、网络流异常检测方法及相关装置
CN112800142B (zh) * 2020-12-15 2023-08-08 赛尔网络有限公司 Mr作业处理方法、装置、电子设备及存储介质
CN112910881A (zh) * 2021-01-28 2021-06-04 武汉市博畅软件开发有限公司 一种基于通信协议的数据监控方法及系统
CN112990108B (zh) * 2021-04-19 2022-12-27 四川省水利科学研究院 一种基于卷积神经网络实现堤坝护坡的系统
CN113225331A (zh) * 2021-04-30 2021-08-06 中国科学技术大学 基于图神经网络的主机入侵安全检测方法、系统及装置
CN113347659B (zh) * 2021-06-01 2022-12-23 深圳市大数据研究院 流量预测方法及装置
CN114459760B (zh) * 2021-12-31 2024-05-24 南京理工大学 一种强噪声环境下的滚动轴承故障诊断方法及系统
CN114422623B (zh) * 2022-01-17 2022-11-18 山西省信息通信网络技术保障中心 一种基于指令序列的车联网异常流量识别方法及装置
CN115396346B (zh) * 2022-08-30 2023-11-28 北京知道创宇信息技术股份有限公司 仿真压力测试方法、装置、系统和电子设备
CN115549780B (zh) * 2022-08-30 2024-06-14 北京邮电大学 光通信网络性能参数监测方法及装置
CN116170384A (zh) * 2023-04-24 2023-05-26 北京智芯微电子科技有限公司 边缘计算业务感知方法及装置、边缘计算设备
CN117041360A (zh) * 2023-06-02 2023-11-10 广州大学 一种基于自监督学习的网络流独立编码方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160283859A1 (en) * 2015-03-25 2016-09-29 Cisco Technology, Inc. Network traffic classification
CN109167680A (zh) * 2018-08-06 2019-01-08 浙江工商大学 一种基于深度学习的流量分类方法
CN109361617A (zh) * 2018-09-26 2019-02-19 中国科学院计算机网络信息中心 一种基于网络包载荷的卷积神经网络流量分类方法及系统
CN109639481A (zh) * 2018-12-11 2019-04-16 深圳先进技术研究院 一种基于深度学习的网络流量分类方法、系统及电子设备

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10154051B2 (en) * 2016-08-31 2018-12-11 Cisco Technology, Inc. Automatic detection of network threats based on modeling sequential behavior in network traffic
GB201714917D0 (en) * 2017-09-15 2017-11-01 Spherical Defence Labs Ltd Detecting anomalous application messages in telecommunication networks
CN108200030A (zh) * 2017-12-27 2018-06-22 深信服科技股份有限公司 恶意流量的检测方法、系统、装置及计算机可读存储介质
CN109995601B (zh) * 2017-12-29 2020-12-01 中国移动通信集团上海有限公司 一种网络流量识别方法及装置
US11368476B2 (en) * 2018-02-22 2022-06-21 Helios Data Inc. Data-defined architecture for network data management
CN109104441A (zh) * 2018-10-24 2018-12-28 上海交通大学 一种基于深度学习的加密恶意流量的检测系统和方法
CN109981485A (zh) * 2019-03-25 2019-07-05 北京理工大学 基于长短期记忆网络的V2ray流量识别方法
KR102046789B1 (ko) * 2019-04-05 2019-11-20 호서대학교 산학협력단 웹 어플리케이션에 대한 딥러닝 기반의 침입탐지 방법, 시스템 및 컴퓨터 프로그램
CN110213244A (zh) * 2019-05-15 2019-09-06 杭州电子科技大学 一种基于时空特征融合的网络入侵检测方法
CN110138787A (zh) * 2019-05-20 2019-08-16 福州大学 一种基于混合神经网络的异常流量检测方法及系统
CN110147877A (zh) * 2019-05-24 2019-08-20 福州大学 基于卷积长短时网络的pm2.5预测方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160283859A1 (en) * 2015-03-25 2016-09-29 Cisco Technology, Inc. Network traffic classification
CN109167680A (zh) * 2018-08-06 2019-01-08 浙江工商大学 一种基于深度学习的流量分类方法
CN109361617A (zh) * 2018-09-26 2019-02-19 中国科学院计算机网络信息中心 一种基于网络包载荷的卷积神经网络流量分类方法及系统
CN109639481A (zh) * 2018-12-11 2019-04-16 深圳先进技术研究院 一种基于深度学习的网络流量分类方法、系统及电子设备

Cited By (33)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113408202B (zh) * 2021-06-18 2022-04-08 国网湖南省电力有限公司 面向变电站核心工控业务的流量基线模型构造方法
CN113408202A (zh) * 2021-06-18 2021-09-17 国网湖南省电力有限公司 面向变电站核心工控业务的流量基线模型构造方法
WO2023016159A1 (zh) * 2021-08-12 2023-02-16 北京邮电大学 智慧城市网络流量预测方法及系统
WO2023040962A1 (zh) * 2021-09-18 2023-03-23 深圳比特微电子科技有限公司 参数配置模型的训练方法、参数配置方法和参数配置设备
CN113949653A (zh) * 2021-10-18 2022-01-18 中铁二院工程集团有限责任公司 一种基于深度学习的加密协议识别方法及系统
CN113949653B (zh) * 2021-10-18 2023-07-07 中铁二院工程集团有限责任公司 一种基于深度学习的加密协议识别方法及系统
CN114358118A (zh) * 2021-11-29 2022-04-15 南京邮电大学 一种基于跨模态特征融合的多任务加密网络流量分类方法
CN114818933A (zh) * 2021-12-23 2022-07-29 金数信息科技(苏州)有限公司 一种基于Epsilon贪心算法监测人工流量作弊的方法及装置
CN114818933B (zh) * 2021-12-23 2024-05-28 金数信息科技(苏州)有限公司 一种基于Epsilon贪心算法监测人工流量作弊的方法及装置
CN114338853A (zh) * 2021-12-31 2022-04-12 西南民族大学 一种工业互联网下的区块链流量监检测方法
CN114338853B (zh) * 2021-12-31 2022-09-20 西南民族大学 一种工业互联网下的区块链流量监检测方法
CN114520838A (zh) * 2022-01-11 2022-05-20 北京交通大学 一种基于k近邻的自定义协议应用层的网络报文匹配方法
CN114520838B (zh) * 2022-01-11 2023-10-17 北京交通大学 一种基于k近邻的自定义协议应用层的网络报文匹配方法
CN114338437A (zh) * 2022-01-13 2022-04-12 北京邮电大学 网络流量分类方法、装置、电子设备及存储介质
CN114338437B (zh) * 2022-01-13 2023-12-29 北京邮电大学 网络流量分类方法、装置、电子设备及存储介质
CN114679310A (zh) * 2022-03-22 2022-06-28 安徽赛福贝特信息技术有限公司 一种网络信息安全检测方法
CN114793197A (zh) * 2022-03-29 2022-07-26 广州杰赛科技股份有限公司 基于nfv的网络资源配置方法、装置、设备及存储介质
CN114793197B (zh) * 2022-03-29 2023-09-19 广州杰赛科技股份有限公司 基于nfv的网络资源配置方法、装置、设备及存储介质
CN114844840A (zh) * 2022-04-26 2022-08-02 哈尔滨工业大学 一种基于计算似然比的分布外网络流量数据检测方法
CN114844840B (zh) * 2022-04-26 2024-04-02 哈尔滨工业大学 一种基于计算似然比的分布外网络流量数据检测方法
CN115297016B (zh) * 2022-05-07 2024-02-20 国网江苏省电力有限公司淮安供电分公司 一种基于深度学习的电力网络活跃度评价和预测方法
CN115297016A (zh) * 2022-05-07 2022-11-04 国网江苏省电力有限公司淮安供电分公司 一种基于深度学习的电力网络活跃度评价和预测方法
CN115277888B (zh) * 2022-09-26 2023-01-31 中国电子科技集团公司第三十研究所 一种移动应用加密协议报文类型解析方法及系统
CN115277888A (zh) * 2022-09-26 2022-11-01 中国电子科技集团公司第三十研究所 一种移动应用加密协议报文类型解析方法及系统
CN115712614A (zh) * 2022-11-07 2023-02-24 航科广软(广州)数字科技有限公司 基于数据传输流控制的信息处理方法及系统
CN116029219A (zh) * 2023-02-27 2023-04-28 中国空气动力研究与发展中心计算空气动力研究所 一种飞行器气动热预测方法、装置、设备及存储介质
CN116029219B (zh) * 2023-02-27 2023-07-07 中国空气动力研究与发展中心计算空气动力研究所 一种飞行器气动热预测方法、装置、设备及存储介质
CN116647877B (zh) * 2023-06-12 2024-03-15 广州爱浦路网络技术有限公司 一种基于图卷积模型的流量类别验证方法和系统
CN116647877A (zh) * 2023-06-12 2023-08-25 广州爱浦路网络技术有限公司 一种基于图卷积模型的流量类别验证方法和系统
CN116708313B (zh) * 2023-08-08 2023-11-14 中国电信股份有限公司 流量检测方法、流量检测装置、存储介质和电子设备
CN116708313A (zh) * 2023-08-08 2023-09-05 中国电信股份有限公司 流量检测方法、流量检测装置、存储介质和电子设备
CN117463506A (zh) * 2023-12-26 2024-01-30 浙江佳环电子有限公司 自适应恒流恒压控制高压电源
CN117463506B (zh) * 2023-12-26 2024-03-22 浙江佳环电子有限公司 自适应恒流恒压控制高压电源

Also Published As

Publication number Publication date
CN110896381B (zh) 2021-10-29
CN110896381A (zh) 2020-03-20

Similar Documents

Publication Publication Date Title
WO2021103135A1 (zh) 一种基于深度神经网络的流量分类方法、系统及电子设备
WO2020119662A1 (zh) 一种网络流量分类方法
WO2020119481A1 (zh) 一种基于深度学习的网络流量分类方法、系统及电子设备
CN108540338B (zh) 基于深度循环神经网络的应用层通信协议识别的方法
CN111431819A (zh) 一种基于序列化的协议流特征的网络流量分类方法和装置
CN115277888B (zh) 一种移动应用加密协议报文类型解析方法及系统
CN115567269A (zh) 基于联邦学习与深度学习的物联网异常检测方法及系统
CN113938290B (zh) 一种用户侧流量数据分析的网站去匿名方法和系统
Chen et al. A novel detection model for abnormal network traffic based on bidirectional temporal convolutional network
WO2024061141A1 (zh) 共性知识约束的遥感样本迁移方法
CN110995770B (zh) 一种模糊测试应用效果对比方法
CN115348215B (zh) 一种基于时空注意力机制的加密网络流量分类方法
CN116578436A (zh) 基于异步多元时间序列数据的实时在线检测方法
CN114884894B (zh) 一种基于迁移学习的半监督网络流量分类方法
CN114979017A (zh) 基于工控系统原始流量的深度学习协议识别方法及系统
CN113992542A (zh) 一种基于新增流数目特征的在线网络流量预测方法及系统
Ma et al. Bi-ETC: A Bidirectional Encrypted Traffic Classification Model Based on BERT and BiLSTM
CN116055224B (zh) 基于时空超图卷积的加密应用程序行为流量检测方法
Wang et al. Encrypted Traffic Classification Model Based on SwinT-CNN
CN115442309B (zh) 一种基于图神经网络的包粒度网络流量分类方法
Wang et al. Feature Extraction and Attack Correlation Detection in Power Communication Networks Based on Convolutional Neural Networks
Rojas et al. Detecting Network Degradation Using Machine Learning Predicting abnormal network behavior with anomaly detection
Xiong et al. Detecting Anomalous Traffic in IoT Networks Through Deep Learning
Liu et al. Intrusion Detection Based on Feature Reduction and Model Pruning in Electricity Trading Network
Yin et al. An Intrusion Detection Model Based on Random Tree Algorithm with Dimensionality Reduction and Oversampling

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19954646

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19954646

Country of ref document: EP

Kind code of ref document: A1

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 17/01/2023)

122 Ep: pct application non-entry in european phase

Ref document number: 19954646

Country of ref document: EP

Kind code of ref document: A1