基于UDP统计指印混合模型的VoIP流量识别方法  

VoIP Traffic Identification Based on UDP Statistical Fingerprinting Mixture Models

作　　者：丁要军[1,2] 蔡皖东[1] 姚烨[1] 

机构地区：[1]西北工业大学计算机学院,西安710129 [2]咸阳师范学院信息工程学院,咸阳712000

出　　处：《计算机科学》2013年第9期136-140,共5页Computer Science

基　　金：国家高技术研究发展计划(863)项目(2009AA01Z424);陕西省教育厅科研计划项目(12JK0933);咸阳师范学院专项科研基金项目(12XSYK068;10XSYK308;07XSYK280)资助

摘　　要：针对VoIP加密负载流量识别的难题,提出一种基于UDP统计指印混合模型的VoIP流量识别方法,以提高VoIP流量的识别精度和分类稳定性。该模型改进了统计指印模型中基于单一的网络流相异度来判定流量类别的方法,将UDP流的统计特征与网络流的统计指印相异度结合以共同训练一个支持向量机分类模型,把基于分类阈值点的分类转换到基于多维特征的高维空间中的分类面的分类,综合运用包层次和流层次统计特征,降低了因网络不稳定造成的统计特征偏差对分类模型精确度的影响。实验结果表明,该模型对VoIP流量的分类精确度达到97%以上,与统计指印模型和支持向量机模型相比分类稳定性更好。Because it is difficult to identify encrypted VolP traffic,we proposed a UDP statistical fingerprinting mixture models to enhance the accuracy and stability of VoIP traffic identification. We used the statistical features of UDP flow along with the anomaly score of traffic flow in which the statistical fingerprinting model is used to identify a traffic flow to train a Support Vector Machine（SVM）classification model, and used a hyperplane of high-dimensional space instead of a threshold point to classify the traffic. Because we use both the packet level features and flow level features in our mixture models, the impact of the deviation of traffic features which is caused by the instability of network will be de- creased. The results of our experiment show that the precision of VoIP traffic is over 97 % in our model, and our model is more stable compare with the statistical fingerprinting model and Support Vector Machine（SVM）.

关 键 词：统计指印 VOIP 流量分类 支持向量机 互联网 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]