基于链路同质性的应用层流量分类方法

Application Layer Traffic Classification Based on Link Homophily

随着高速网络链路中数据量的剧增,以及越来越多的流行应用使用动态端口或使用加密流量通信,导致传统的网络流量分类方法失效.本文研究了应用层流量中存在的链路同质性,结合统计关联学习方法和流量传播图挖掘方法,提出了一种基于链路同质性的应用层流量分类方法.我们分析数据集中邻接链路之间的统计依赖关系并应用于网络协议识别,而不依赖于数据包载荷与网络流特征.实验结果表明,本文提出的方法能够实现超过80%的流量识别精度.

With the data volume soaring in high speed network link, more and more popular applications use dynamic ports or other protocols as wrappers, leading to traditional traffic classification method less reliable. A new method is proposed based on link homophily in application layer traffic. This method combines the statistical rela- tional learning method and the trace graph digging method. The statistical dependencies between flows is analysed that they share common IP hosts in trace graph. And these dependencies are utilized to classify application layer traffic without the payloads and properties at the flow level. In all the experimental traces, our method achieves a- bove 80% accuracy.