基于PrefixSpan的网络流量识别特征自动提取算法  

Automatic Signature Extraction Algorithm from Network Applications Based on PrefixSpan

作　　者：栗彪 张白愚[1] 黄焱[1] 

机构地区：[1]信息工程大学,河南郑州450001

出　　处：《信息工程大学学报》2014年第6期743-747,共5页Journal of Information Engineering University

摘　　要：基于深度报文检测的网络流量识别方法因其识别准确率高在现有网络流量识别设备中应用广泛,但其识别特征的自动提取存在困难。提出了基于Prefix Span算法的连续序列模式挖掘算法,在连续序列和偏移属性约束下,引入跨度策略,在网络流量中自动提取同一网络协议或应用的应用层签名特征。实验结果表明,该算法减小了投影数据库的规模,具有良好的时间性能,挖掘的应用层签名特征规模小,可有效地应用于网络流量识别。The algorithm based on deep packet inspection is more accurate and real-time than other algorithms in network traffic identification. So the deep packet inspection algorithm has widely ap- plied in network traffic identification systems. However, few papers make researches on the automat- ic signature extraction from network applications. This paper proposes a mining algorithm of continu- ous sequential patterns based on the PrefixSpan algorithm. The proposed algorithm introduces the span policy, automatically extracting the signatures from the same network application on the con- straint of continuous sequential pattern and offset. Experiential results show that the proposed algo- rithm reduces the size of the projected database and final signatures database, has a good perform- ance, and can efficiently apply to network traffic identification.

关 键 词：数据挖掘 序列模式 投影数据库 跨度策略 应用层签名 

分 类 号：TN393[电子电信—物理电子学]