基于离散载荷特征的即时通讯软件流量分类方法  

Traffic classification of instant messaging software based on discrete load characteristics

作　　者：崔弘[1] 蒋言 郭士串 汪洋[1] Cui Hong;Jiang Yan;Guo ShiChuan;Wang Yang(Fiber Home Telecommunication Technologies Co.Ltd.,Jiangsu Nanjing 210019)

机构地区：[1]烽火通信科技股份有限公司,江苏南京210019

出　　处：《网络空间安全》2020年第8期28-33,共6页Cyberspace Security

基　　金：下一代网络处理器体系结构及关键技术研究(项目编号:2018YFB1800602)。

摘　　要：随着大数据时代到来,海量即时通讯软件流量分类成为解决网络拥塞、安全监管、网络异常检测等研究的基础。针对传统流量识别与分类技术准确率低、速率慢等问题,文章提出一种基于离散载荷特征的即时通讯软件流量分类技术。该技术通过对通讯软件报文数据进行五元组数据提纯,利用信息熵对载荷特征进行离散化,结合XGBoost构建通讯软件数据报文的二分类模型,同时将其效果与随机森林、SVM和朴素贝叶斯的方法做对比试验。结果表明,这种方法较传统流量分类方法准确率提高4.3%,与采用连续特征分类相比分类准确率提高2.3%,同时具有处理速度快、适用性广泛的特点。With the advent of the era of big data,massive instant messaging software traffic classification has become the basis of solving network congestion,security supervision,network anomaly detection and other research.Aiming at the problems of low accuracy and slow speed of traditional traffic identification and classification technology,this paper proposes an instant messaging software traffic classification technology based on discrete load characteristics.This technology is based on the five tuple data purification of the message data of the communication software,the discretization of the load characteristics by using the information entropy,and the construction of the two classification model of the message data of the communication software by combining XGBoost.At the same time,the effect is compared with the methods of random forest,SVM and naive Bayes.The results show that the accuracy of this method is 4.3% higher than that of traditional traffic classification method,and 2.3% higher than that of continuous feature classification.At the same time,this method has the characteristics of fast processing speed and wide applicability.

关 键 词：信息熵 XGBoost 流量识别 五元组 离散载荷 

分 类 号：D90-052[政治法律—法学理论]