基于时序特征的网络流量分类方法  

Network Traffic Classification Method Based on Time Series Features

作　　者：赵力强 师智斌[1] 石琼[1] 雷海卫[1] ZHAO Liqiang;SHI Zhibin;SHI Qiong;LEI Haiwei(School of Data Science and Technology,North University of China,Taiyuan 030051,China)

机构地区：[1]中北大学大数据学院,山西太原030051

出　　处：《中北大学学报（自然科学版）》2022年第3期221-228,共8页Journal of North University of China(Natural Science Edition)

基　　金：山西省自然科学基金资助项目(20210302123075);山西省重点研发计划资助项目(201903D121166)。

摘　　要：网络流量数据具有明显的时序特征.针对基于机器学习的网络流量分类方法中,传统机器学习依赖人工设计特征以及深度学习无法兼顾特征自主生成与特征可解释性等问题,采用时序分析方法,提出了一种基于时序特征的网络流量分类方法.首先,将网络流量数据预处理为时序数据;然后,应用Shapelet-Transform算法来自主学习网络流量的时序特征,并改写Shapelet-Transform算法的计算逻辑,且将其部署在GPU上,使其可以快速处理大规模网络流量数据集;最后,结合支持向量机分类算法构造了最优分类模型来实现网络流量分类.公开数据集实验测试结果表明,所提方法可以实现网络流量时序特征的自主学习,并达到与深度学习接近的分类精度,同时给出深度学习方法无法提供的可解释性分类依据.Network traffic data has obvious time series features.In the network traffic classification method based on machine learning,traditional machine learning depends on manual design features,and deep learning cannot realize the independent generation of features and the interpretability of features at the same time.To solve these problems,a traffic classification method based on time series features was proposed by using time series analysis method in this paper.Firstly,the network traffic data was represented to time series.Then,the time series features were extracted from traffic data through Shapelet-Transform algorithm,and the algorithm calculation logic was rewritten so it could be deployed on the GPU to process large-scale traffic data set quickly.Finally,combined with the support vector machine classification algorithm,the optimal classification model was constructed to realize the traffic classification.The experimental results with the public data set show that the proposed method can realize the independent learning of network traffic time series features,and achieve the classification accuracy close to deep learning.The method can also provide interpretable classification basis which cannot be provided by deep learning methods.

关 键 词：网络流量分类 时序特征 Shapelet-Transform 可解释性 GPU 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]