分类不平衡协议流的机器学习算法评估与比较

Machine Learning Algorithms for Classifying the Imbalanced Protocol Flows:Evaluation and Comparison

网络协议流不平衡环境下,流样本分布的变化对基于机器学习的流量分类器准确性及稳定性有较大的影响.选择合适的机器学习算法以适应网络协议流不平衡环境下的在线流量分类,显得格外重要.为此,首先通过单因子实验设计,验证了C4.5决策树、贝叶斯核估计(NBK)和支持向量机(SVM)这3种分类算法统计TCP连接开始的前4个数据包足以分类流量.接着,比较了上述3种分类算法的性能,发现C4.5决策树的测试时间最短,SVM分类算法最稳定.然后,将Bagging算法应用到流量分类中.实验结果表明,Bagging分类算法的稳定性与SVM相似,且测试时间与建模时间接近于C4.5决策树,因此更适于在线分类流量.

In the case of the imbalanced protocol flows, the changes of flow distribution have a huge impact on the accuracy and stability of traffic classifiers that use machine learning algorithms. It is very important to select a suitable machine learning algorithm to classify the imbalanced protocol flows on line. By means of single-factor experiment design, this paper verifies that it is possible for C4.5 decision tree, Naive Bayes with kernel density estimation （NBK） and support vector machine （SVM） to classify traffic with the first four packets of the TCP connection. After comparing the performances of the three classifiers abovementioned, the study finds that the testing time of C4.5 decision tree is the shortest and SVM is the most stable. Finally, Bagging algorithm is applied to classify traffic. The experimental results show that, the stability of Bagging is similar to SVM and the testing time and modeling time of Bagging is close to C4.5 decision tree. Therefore, Bagging classifier is the most suitable to classify traffic on line.