基于主动学习和SVM方法的网络协议识别技术

Network protocol identification based on active learning and SVM algorithm

针对未知网络协议数据流的获取与标记工作主要依赖于领域专家。然而,样本数据量的增加会导致人工成本超过实际负荷。提出了一种新颖的未知网络协议识别方法。该方法基于主动学习算法,仅依靠原始网络数据流的载荷部分实现对未知网络协议的有效识别。实验结果表明,采用该方法设计的识别系统在保证识别准确率和召回率的前提下,能够有效地降低学习过程中标记的样本数目,更适用于实际的网络应用环境。

Obtaining qualified training data for protocol identification generally requires domain experts to be involved, which is timeconsuming and laborious. A novel approach for network protocol identification based on active learning and SVM algorithm was proposed. The experimental evaluations on realworld network traces show this approach can accurately and efficiently classify the target network protocol from mixed Intemet traffic, and meanwhile display a sig nificant reduction in the number of labeled samples. Therefore, this approach can be employed as an auxiliary tool for analyzing unknown protocols in realworld environment.