CAJ | 학술논문

为快速将网络应用的流量进行分类，以Auckland Ⅱ和UNIBS两个数据集的网络流量包为研究对象，选取网络应用程序流量中最初的8个有效载荷大小作为识别特征进行研究。由于这类特征可在早期流量阶段快速提取，因此效果显著。通过将早期载荷大小可视化的方式，分析了不同网络应用的行为模式。分析结果表明，多数网络应用程序可通过早期有效载荷大小显示出它们特有的行为模式，根据早期有效载荷大小的信息可对流量进行有效识别。在此基础上，选用3种典型的机器学习分类器，即朴素的贝叶斯分类器、朴素的贝叶斯树和径向基函数神经网络进行验证分析。实验结果显示，早期有效载荷大小可作为特征对流量进行有效识别。
위쾌속장망락응용적류량진행분류，이Auckland Ⅱ화UNIBS량개수거집적망락류량포위연구대상，선취망락응용정서류량중최초적8개유효재하대소작위식별특정진행연구。유우저류특정가재조기류량계단쾌속제취，인차효과현저。통과장조기재하대소가시화적방식，분석료불동망락응용적행위모식。분석결과표명，다수망락응용정서가통과조기유효재하대소현시출타문특유적행위모식，근거조기유효재하대소적신식가대류량진행유효식별。재차기출상，선용3충전형적궤기학습분류기，즉박소적패협사분류기、박소적패협사수화경향기함수신경망락진행험증분석。실험결과현시，조기유효재하대소가작위특정대류량진행유효식별。
In order to classify the Internet traffic of different Internet applications more quickly two open Internet traffic traces AucklandⅡand UNIBS traffic traces are employed as study objects. Eight earliest packets with non-zero flow payload sizes are selected and their payload sizes are used as the early-stage flow features.Such features can be easily and rapidly extracted at the early flow stage which makes them outstanding. The behavior patterns of different Internet applications are analyzed by visualizing the early-stage packet size values. Analysis results show that most Internet applications can reflect their own early packet size behavior patterns.Early packet sizes are assumed to carry enough information for effective traffic identification.Three classical machine learning classifiers i.e. the naive Bayesian classifier naive Bayesian trees and the radial basis function neural networks are used to validate the effectiveness of the proposed assumption.The experimental results show that the early stage packet sizes can be used as features for traffic identification.