基于多标签分类算法的网络通信端口流量异常值快速捕获  

Fast Capture of Abnormal Traffic Values in Network Communication Ports Based on Multi Label Classification Algorithm

作　　者：庞建成 樊蒙蒙 PANG Jiancheng;FAN Mengmeng(Modern Education Technology Center of Luohe Vocational and Technical College,Luohe,Henan 462000)

机构地区：[1]漯河职业技术学院现代教育技术中心,河南漯河462000

出　　处：《长江信息通信》2024年第5期162-164,共3页Changjiang Information & Communications

摘　　要：由于网络通信端口流量状态具有实时更新的特征,导致异常值捕获的难度较大,为此,提出基于多标签分类算法的网络通信端口流量异常值快速捕获方法研究。通过对网络通信端口流量的统计特征(流量的大小、流量的方向、流量的协议类型)进行分析和计算,为每个网络通信端口生成一组具有代表性的标签,利用GCN学习一组相互依赖的网络通信端口流量数据标签分类器,设计对应的分类器的输入由节点以及标签相关矩阵构成,具体的节点表示形式为网络通信端口流量数据标签的特征向量,网络通信端口流量数据标签对的出现次数作为建立相关矩阵的执行基础,分类器输出使用网络通信端口流量数据标签共现矩阵对应的条件概率矩阵为空时,确定此时的网络通信端口流量数据为异常值。在测试结果中,对端口流量异常值捕获结果的ACC始终稳定在0.85以上,对端口流量异常值捕获结果的F1-score始终稳定在0.83以上,与对照组的测试结果相比,具有明显优势。Due to the real-time updating characteristics of network communication port traffic status,it is difficult to capture outliers.Therefore,a fast capture method for network communi-cation port traffic outlicrs based on multi label classification algorithm is proposed.By analyzing and calculating the statistical characteristics of network communication port traffic(size,dircc-tion,and protocol type of traffic),a representative set of labels is generated for each network communication port.GCN is used to learn a set of interdependent network communication port traffic data label classifiers,and the corresponding classifier input is composed of nodes and label correlation matrices,The specific node representation form is the feature vector of the network communication port traffic data label.The number of occurrences of the network communica-tion port traffic data label pair is used as the execution basis for establishing the correlation ma-trix.When the classifier outputs the conditional probability matrix corresponding to the co-oc-currence matrix of the nctwork communication port traffic data label,it is determined that the network communication port traffic data at this time is an outlier.In the test results,the ACC of the capture results of port traffic outliers remained stable above 0.85,and the Fl score of the capture results of port traffic outlicrs remaincd stable above 0.83.Compared with the test rc-sults of the control group,it has a significant advantage.

关 键 词：多标签分类算法 网络通信端口流量异常值快速捕获 GCN学习 标签分类器 

分 类 号：TU247[建筑科学—建筑设计及理论]