基于卡方统计的应用协议流量行为特征分析方法  

Analyzing the Characteristics of Application Traffic Behavior Based on Chi-Square Statistics

作　　者：陈亮[1,2] 龚俭[1,2] 

机构地区：[1]东南大学计算机科学与工程学院,江苏南京210096 [2]江苏省计算机网络技术重点实验室,江苏南京210096

出　　处：《软件学报》2010年第11期2852-2865,共14页Journal of Software

基　　金：国家重点基础研究发展计划(973)No.2009CB320505;国家科技支撑计划No.2008BAH37B04~~

摘　　要：引入统计理论中的卡方统计检验,提出一种通用的应用协议流量行为特征分析方法——ABSA(application behavior significance assessment).该方法不针对特定的应用协议,旨在提出描述各应用协议间行为测度分布差异情况的统一量化标准,使其可进行比较,从而判断各协议的流量行为特征,并评估相应的显著程度.理论分析及实验结果表明,ABSA方法不仅可以为协议识别提供更丰富、更准确的特征信息,优化协议识别的结果,而且保证特征显著程度的评估与协议样本在总样本中所占的比例无关,并可用于NetFlow等路由器所用的报文抽样环境下,保持以任意比例抽样后的特征相对显著程度顺序评估结果不变,简化了抽样比变化时的特征重选择过程.Based on the Chi-Square Statistics and Test,this paper proposes a method named ABSA（application behavior significance assessment） to analyze the traffic behavior characteristics of applications.The ABSA method does not focus on any certain applications;in contrast,it aims at providing a quantitative standard for describing the behavior distribution differences among applications,so that the traffic behavior characteristics and their corresponding significances can be determined.The theoretical analysis and experiments results show that 1） ABSA can present the information about characteristics more precisely and copiously to improve the accuracy of application identification;2） the significance of characteristic is independent of its proportion in sample totals;3） ABSA can keep the relative significance sequence of behavior characteristics unchanged in a packet sampling environment,which is often used by NetFlow and many other flow information collecting systems to simplify the characteristic re-selecting process when sampling ratio is changed.

关 键 词：网络行为 应用协议 流量分类 行为特征 卡方统计 报文抽样 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]