基于支持向量机的Internet流量分类研究  

Internet Traffic Classification Using Support Vector Machine

作　　者：徐鹏[1,2] 刘琼[1,2] 林森[1,2] 

机构地区：[1]中国科学院软件研究所,北京100190 [2]中国科学院研究生院,北京100049

出　　处：《计算机研究与发展》2009年第3期407-414,共8页Journal of Computer Research and Development

基　　金：国家"九七三"重点基础研究发展计划基金项目(2007CB307100;2007CB307106)~~

摘　　要：准确的网络流量分类是众多网络研究工作的基础,也一直是网络测量领域的研究热点.近年来,利用机器学习方法处理流量分类问题成为了该领域一个新兴的研究方向.在目前研究中应用较多的是朴素贝叶斯(nave Bayes,NB)及其改进算法.这些方法具有实现简单、分类高效的特点.但该方法过分依赖于样本空间的分布,具有内在的不稳定性.因此,提出一种基于支持向量机(support vector machine,SVM)的流量分类方法.该方法利用非线性变换和结构风险最小化(structural risk minimization,SRM)原则将流量分类问题转化为二次寻优问题,具有良好的分类准确率和稳定性.在理论分析的基础上,通过在实际网络流集合上与朴素贝叶斯算法的对比实验,可以看出使用支持向量机方法处理流量分类问题,具有以下3个优势:1)网络流属性不必满足条件独立假设,无须进行属性过滤;2)能够在先验知识相对不足的情况下,仍保持较高的分类准确率;3)不依赖于样本空间的分布,具有较好的分类稳定性.Accurate traffic classification is the keystone of numerous network activities, so it has been a hot topic in network measurement for a long time. In recent years, Internet traffic classification using machine learning has been a new direction in this area. Naive Bayes and its improved methods have been widely used in this area, because they are simple and efficient. However, these methods depend on the probability distribution of sample space, so they have connatural instability. In order to handle this problem, a new method based on support vector machine SVM） is proposed in this paper. This method converts the Internet traffic classification problem to a quadratic optimization problem using non-linear transformation and structural risk minimization, which performs good accuracy and stability. After the theoretical analysis, the comparison experiments with Naive Bayes and its improved methods on traffic sets are given. The experiment results validate that support vector machine method has three advantages in Internet traffic classification： Firstly, it is not necessary for flow attributes to satisfy the independence hypothesis, so feature selection is not required. Secondly, this method can work well with poor priori knowledge. Lastly, this method doesn＇t use the probability distribution of sample space, so it can classify Internet traffic stably.

关 键 词：流量分类 网络测量 网络流 支持向量机 统计属性 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]