网络汇聚点传输层拓扑的流量识别

Traffic identification based on transport-layer topology at network aggregation point

针对利用数据流统计特性的网络流量分类算法复杂及实时性差的问题,提出一种基于传输层拓扑的网络流量识别方法,根据应用类型在汇聚节点表现出不同的主机连接拓扑结构,提取应用类型的拓扑特征,结合深度包检测(DPI)技术生成应用类型库,并基于该库和启发式准则实现典型应用类型的快速识别和分类。实验结果表明,所提方法对各主要应用类型的识别精确度均高于85%,并将未识别流比例从深度包检测技术的18%降低到7%,有效利用了不同应用类型的连接拓扑信息,能提高应用类型的识别准确度。

Considering the complexity and poor real-time quality of classification algorithms based on the statistical characteristics of network traffic,a new traffic identification method was proposed based on transport-layer topology.According to the different host connection characteristics in terms of application types at aggregation point,the proposed method extracted topological characteristics of application types by capturing the transport layer connection information,and then produced application type pools based on Deep-in Packet Inspection（DPI） technique,finally identified the application types of traffic combining the pools and heuristic rules.The experimental results show that the proposed method gains precision higher than 85% for identifying main application types and reduces ratio of un-identified flows from 18% to 7%.It utilizes transport-layer topology information of different application types and can enhance the recognition accuracy of application types.