加密流量分类的特征回放集成学习方法  

Encrypted Traffic Classification with Ensemble Learning Based on Feature Playback

作　　者：梁翔宇 张恒汝[1] 周瑶 余一帆[1] 闵帆[1,2] LIANG Xiangyu;ZHANG Hengru;ZHOU Yao;YU Yifan;MIN Fan(School of Computer Science,Southwest Petroleum University,Chengdu 610500,China;Institute for Artificial Intelligence,Southwest Petroleum University,Chengdu 610500,China)

机构地区：[1]西南石油大学计算机科学学院,四川成都610500 [2]西南石油大学人工智能研究院,四川成都610500

出　　处：《山西大学学报（自然科学版）》2023年第1期1-9,共9页Journal of Shanxi University(Natural Science Edition)

基　　金：国家自然科学基金(61902328);南充市科技局应用基础研究项目(SXHZ040);中央引导地方科技发展专项资金(2021ZYD0003)。

摘　　要：针对加密流量特征稀疏与难以通过单一方法进行表征的问题,文章提出一种基于特征回放的集成学习方法,包括预特征提取、特征回放、集成学习三个阶段。首先,收集报文的到达平均时间间隔、最大长度等常用统计信息作为数据集的原始特征,其次,训练多个预分类器并将这些分类器的预测结果作为新的特征加入数据集中,最后,借鉴Stacked Generalization的集成思想训练最终的决策分类器。利用Cyberflood构建多种类别的加密流量数据并进行相关实验,结果表明本文方法在准确率上比已有分类方法提高了近5%。It was challenging to characterize encrypted traffic in one way since its sparse nature. This paper proposes an ensemble learning method based on feature playback, including three stages: feature extraction, feature playback and integrated learning.First, the common statistical information such as average arrival time interval and maximum length of packets were extracted as the original features of the dataset. Second, the predictions of the trained pre-classifier were added to the dataset as new features. Finally, the final decision classifier was trained based on the ensemble concept of Stacked Generalization. Cyberflood was used to create different types of encrypted traffic data and relevant experiments were carried out. The results showed that the accuracy of our method is nearly 5% higher than that of the existing classification methods.

关 键 词：加密流量分类 集成学习 特征回放 特征提取 统计信息 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]