一种基于机器学习的网络流早期分类方法

Machine learning-based early classification for network traffic

流早期分类对于优化网络管理和确保服务质量(Quality of Service, QoS)至关重要。针对传统流特征在流早期分类中性能较低的问题,在现有研究基础上,提出了两种新的特征:一是通过等距分箱划分包大小等级,计算相邻到达的两个数据包的包大小等级条件频度;二是通过将包大小序列和包到达时间间隔对应相除,得到速率序列,并计算该序列的统计特征作为分类特征。同时,考虑到早期分类的实时性要求,分析了流特征计算的时间复杂性,在特征选择中优化了时间和准确性之间的平衡。另外,针对网络视频流量占比较大的情况,提出了一种层级分类结构;先使用较少的数据包进行non-video/video的二分类,再使用后续的数据包,进行non-videos和videos的细粒度分类。采用随机森林在两个实际网络数据集上进行分类性能测试,并与文献方法进行比较,验证了该方法在快速流量分类中的优越性。

Early classification for network traffic is vital for network management and quality of service(QoS). Since conventional features in early classification are ineffective, we propose two methods to obtain two new features:(1) to discretize the packet size(ps) by equal bins, and calculate the conditional frequency of binned ps of two consecutive packets;(2) to obtain the rate sequence by dividing the ps sequence with the corresponding packet inter-arrival time, and calculate the statistics of this sequence as a flow feature. Further, considering the real time requirement of early traffic classification, we analyze the time complexity, and balance the time usage and the accuracy. In addition, given the relatively large percentage of network video traffic on Internet, a hierarchical classification structure is proposed. It uses fewer data packets for non-video/video binary classification, and then uses subsequent data packets for fine-grained classification of non-video and video traffic. Finally, we deploy the random forest to test the classification performance of the proposed method on two real world datasets, and compare it with existing methods. The results demonstrate the superiority of our method for faster classification.