基于行为特征学习的互联网流量分类方法

Internet traffic classification method based on behavior feature learning

基于连接图的互联网流量分类方法能反映主机间的通信行为,具有较高的分类稳定性,但是经验式总结的启发式规则有限,难以获得高分类准确率。研究分析了主机间通信行为模式和BOF方法,从具有相同{目的IP地址,目的端口号,传输层协议}网络流量中,提取主机间连接相关的行为统计特征(HCBF),采用C4.5决策树算法学习基于行为特征的分类规则,其无需人工建立启发式规则。在传统互联网和移动互联网流量数据集上,从基本分类性能和分类稳定性方面,与现有的特征集进行比较分析,实验结果表明,HCBF特征集合的类间区分能力和稳定性较高。

The connection graph based internet traffic classification method can reflect the connectivity behaviorbetween hosts. Thus, it has high stability. But the heuristic rules summarized for traffic classification are generallyincomplete, and they difficultly obtain high classification accuracy. Host communication behavior model and BOFmethod was researched, and a set of host connection related behavior features （HCBF） was extracted from themultiple flows with the same {destination IP, destination port and transport protocol}. To evaluate the performance of HCBF, it was compared with the existing feature set on the respect of basic classification performance andclassification stability. The experiments were carried out on the traffic collected in the traditional and mobilenetworks. Results show that HCBF out performs existing feature sets.