基于流中前5个包的在线流量分类特征  

Features for Online Traffic Classification Based on the First Five Packets of a Flow

作　　者：赵树鹏[1,2] 陈贞翔[1,2] 彭立志[1,2] 

机构地区：[1]山东省网络环境智能计算技术重点实验室,山东济南250022 [2]济南大学信息科学与工程学院,山东济南250022

出　　处：《济南大学学报（自然科学版）》2012年第2期156-160,共5页Journal of University of Jinan(Science and Technology)

基　　金：国家自然科学基金(60903176);山东省中青年科学家科研奖励基金(BS2009DX037);山东省自然科学基金(ZR2010FQ028)

摘　　要：针对在线流量分类所面临的特征计算复杂和分类性能不稳定问题,利用流开始的前5个数据包(排除三次握手数据包),计算数据包大小、负载大小和到达间隔时间等网络流量的统计特征,通过分析3种机器学习算法(C4.5、BayesNet和NBTree)分类的结果,研究可用于在线流量分类的特征以及这些特征应该满足的条件。实验结果表明,所提特征计算简单,能快速有效地区分不同的流量,对于不同的机器学习算法,均取得了较高的分类准确率(92%以上),适用于在线流量分类。Aiming at the problem of feature computing complexity and instable performance in online traffic classification,features for online traffic classification and its necessary conditions are investigated by analyzing the classification result of three kinds of machine learning algorithms.These features include packet size,payload size,inter-arrival time and other network traffic statistic features which are calculated on the first five packets of a flow that removes three-hand-shake packets.Experimental results show that these features are simple to compute and can discriminate different kinds of traffic quickly and effectively.To different kinds of machine learning algorithms,it can obtain high accuracy(above 92%).These features are suitable to online traffic classification.

关 键 词：流量特征 流量分类 网络测量 

分 类 号：TP393.06[自动化与计算机技术—计算机应用技术]