互联网五种典型应用的平均包长概率分布研究  

Research on probability distribution of mean packet size for five representative applications in Internet

作　　者：杜锡寿[1] 陈庶樵[1] 张建辉[1] 马润华 

机构地区：[1]国家数字交换系统工程技术研究中心 [2]海军92564部队

出　　处：《计算机应用研究》2012年第5期1884-1886,1900,共4页Application Research of Computers

基　　金：国家"863"计划资助项目(2009AA01A346)

摘　　要：作为流量识别的一个重要手段,深度流检测使用的统计特征中屡屡包含包长信息。从互联网五种典型应用的平均包长入手,利用滑动窗口模型探索五种应用在平均包长概率分布上的差异。对FTP、Foxmail、WWW、迅雷、Emule五种应用的实验表明:设置相同的滑动窗口,五种应用平均包长的均值有明显区别;设置不断增大的滑动窗口,五种应用平均包长的均值稳定,标准差逐渐减小。仅用包长信息可识别该五种应用。As a important method of traffic identification,DFI（deep flow inspection）employs statistical features which contains packet size information.This paper started with packet size belonging to five representative applications,utilized sliding window model to explore difference on probability distributution of mean packet size of different applications.The experiments on FTP,Foxmail,WWW,Thunder and Emule show：with the same size of sliding window,they behave different expectation of the mean packet size;with being greater size of sliding window,they behave stable expectation and gradually decreasing variance of the mean packet size.It is feasible to identify the five applications only based on packet size information.

关 键 词：流量识别 平均包长 概率分布 滑动窗口 离散随机过程 

分 类 号：TP393.0[自动化与计算机技术—计算机应用技术]