基于流感知的复杂网络应用识别模型

Flow-awared identification model of sophisticated network application

;传统协议识别技术多以单网络流为识别手段,不能应对复杂网络应用多服务、多协议等特性,因此在面对复杂网络应用识别时严重失效。针对复杂网络应用的识别难题,提出了一种流感知模型,从空间、时间和流量3个维度来刻画复杂网络应用的通信特性,深度分析并挖掘了复杂网络应用的行为和状态特征;基于此模型,提出了一套快速识别复杂网络应用的方法和架构。实验结果表明,流感知模型能有效识别复杂网络应用,具有良好的识别效果。

Traditional methods of protocol identification, which is mainly based on individual flow, lose their effective- ness as dealing with sophisticated network applications. A novel model of identifying sophisticated network applications, called flow-aware model, is addressed. This proposed model abstracts the characteristics of sophisticated network appli- cations from spatial dimension, time dimension and flow dimension, and provides the detailed analysis and deeply mining in characteristics of behaviors and states. Based on this model, a framework and method of sophisticated network appli- cations identification is proposed. The experimental results demonstrate that the proposed method can achieve the pur- pose of identifying sophisticated network applications effectively.