Fine-Grained Network Traffic Classification Architecture and Optimization

doi:10.7652/xjtuxb202011015

您当前的位置：

首页 >

文章列表页 >

Fine-Grained Network Traffic Classification Architecture and Optimization

更新时间：2025-07-09

- Fine-Grained Network Traffic Classification Architecture and Optimization
- Vol. 54, Issue 11, Pages: 121-128(2020)
- 作者机构：
  
  1. 西安交通大学电信学部,西安,710049
  2. 通信网信息传输与分发技术重点实验室,石家庄,050081
- 作者简介：
- 基金信息：
- DOI：10.7652/xjtuxb202011015
  CLC： TP393.0
- Online First：10 November 2020，
  
  Published：2020
- 稿件说明：
移动端阅览
Fine-Grained Network Traffic Classification Architecture and Optimization[J]. 2020, 54(11): 121-128.
DOI：

Fine-Grained Network Traffic Classification Architecture and Optimization[J]. 2020, 54(11): 121-128. DOI： 10.7652/xjtuxb202011015.

摘要

针对现有网络流量指纹自动生成难度大、粒度粗及匹配阶段内存消耗大等问题

提出了细粒度网络流量分类架构及其优化。在线下

根据特定字符片段在对应流量中保持不变

且代表流量功能的有效字符片段比随机噪声片段出现的频率高这一特性

寻找流量中字符片段出现频率和长度达到一定阈值的有效片段

并将其作为备选指纹规则

通过交并、合并、指纹提纯操作获取该流量对应的指纹。在线上字符串匹配时

根据k均值分类思想重新定义距离

并利用异构位分割状态机的启发式算法对指纹中的字符串进行重新组织

对内存使用进行优化。实验结果表明:所提算法能够在未知网络流量协议格式的情况下自动生成细粒度的流量指纹

平均识别准确率为93.65%

对噪声不敏感; 在匹配时若将原所有指纹字符片段重新优化组织

当指纹规则数量在4 000以上时

可节约近50%的内存需求。

Abstract

To solve the problems of coarse-grained network traffic fingerprints and large memory consumption in the matching phase

we proposed a fine-grained network traffic classification architecture to achieve automated signature generation and optimize memory. As some portion of the data payload in a function is invariant and the signature reflecting the application function is atypical in internet traffic

the signature generation is mapped into the problem of obtaining the frequently occurring substrings and their corresponding occurrence frequency. In the case of online matching

according to the idea of k-means classification

the distance is redefined and the rules are reorganized using the heuristic heterogeneous bit-split deterministic finite automaton method to achieve the purpose of optimizing memory usage. The experimental results show that without knowing the format of the network traffic protocol

the method can automatically generate fine-grained traffic fingerprints with an average recognition accuracy of 93.65%

and is not sensitive to noise. In addition

if all fingerprint character fragments are re-optimized during matching

when the number of fingerprint rules is above 4 000

it can save nearly 50% of memory requirements compared with the previous bit-split string matching methods.

关键词

Keywords

references

ERMAN J, MAHANTI A, ARLITT M. QRP05-4: internet traffic identification using machine learning [C]∥Proceedings of the IEEE 2016 Global Telecommunications Conference. Piscataway, NJ, USA: IEEE, 2006: 1-6.

WILLIAMS N, ZANDER S, ARMITAGE G. A preliminary performance comparison of five machine learning algorithms for practical IP traffic flow classification [J]. ACM SIGCOMM Computer Communication Review, 2006, 36(5): 5-16.

徐斌. 细粒度用户级的网络流量分析与应用研究 [D]. 上海: 上海交通大学, 2013: 19-25.

YOON S H, PARK J S, KIM M S. Behavior signature for fine-grained traffic identification [J]. Applied Mathematics Information Sciences, 2015, 9(2): 523-534.

熊刚, 孟姣, 曹自刚, 等. 网络流量分类研究进展与展望 [J]. 集成技术, 2012(1): 32-42.

XIONG Gang, MENG Jiao, CAO Zigang, et al. Research progress and prospects of network traffic classification [J]. Journal of Integration Technology, 2012(1): 32-42.

BOYER R S, MOORE J S. A fast string searching algorithm [J]. Communications of the ACM, 1977, 20(10): 762-772.

ABDULLAH A, NAZIR A, SENAPAN M, et al. Fast multi-keyword range search using GPGPU [J]. GPU Computing and Applications, 2015: 259-274.

SOURDIS I, PNEVMATIKATOS D N, VASSILIADIS S. Scalable multigigabit pattern matching for packet inspection [J]. IEEE Transactions on Very Large Scale Integration(VLSI)Systems, 2008, 16(2): 156-166.

XU Kefu, QI Deyu, QIAN Zhengping, et al. Fast dynamic pattern matching for deep packet inspection [C]∥Proceedings of the 2008 IEEE International Conference on Networking, Sensing and Control. Piscataway, NJ, USA: IEEE, 2008: 802-807.

KIM H, KANG S. A pattern group partitioning for parallel string matching using a pattern grouping metric [J]. IEEE Communications Letters, 2010, 14(9): 878-880.

KIM H, CHOI K I, CHOI S I. A memory-efficient deterministic finite automaton-based bit-split string matching scheme using pattern uniqueness in deep packet inspection [J]. PLoS One, 2015, 10(5): e0126517.

AHO A V, CORASICK M J. Efficient string matching: an aid to bibliographic search [J]. Communications of the ACM, 1975, 18(6): 333-340.

LE H, PRASANNA V K. A memory-efficient and modular approach for large-scale string pattern matching [J]. IEEE Transactions on Computers, 2013, 62(5): 844-857.

HUA N, SONG H, LAKSHMAN T V. Variable-stride multi-pattern matching for scalable deep packet inspection [C]∥Proceedings of the 28th IEEE Conference on Computer Communications. Piscataway, NJ, USA: IEEE, 2009: 415-423.

PAO D, LIN W, LIU B. A memory-efficient pipelined implementation of the Aho-Corasick string-matching algorithm [J]. ACM Transactions on Architecture and Code Optimization, 2010, 7(2): 1-27.

YUN S. An efficient TCAM-based implementation of multipattern matching using covered state encoding [J]. IEEE Transactions on Computers, 2012, 61(2): 213-221.

TAN L, BROTHERTON B, SHERWOOD T. Bit-split string-matching engines for intrusion detection and prevention [J]. ACM Transactions on Architecture and Code Optimization, 2006, 3(1): 3-34.

AHO A V. Compilers: principles techniques and tools [M]. 2nd ed. New York, USA: Pearson Education Inc., 2006: 82-101.

Snort. Snort v2.8. web-client dataset [DS/OL]. [2020-01-10]. https: ∥www.snort.org/downloads/#ruledownloads.

ClamAV. ClamAV dataset [DS/OL]. [2020-01-10]. http: ∥www.clamav.net/downloads.

Suricata. Suricata dataset [DS/OL]. [2020-01-10]. https: ∥suricata-ids.org/download/.

PARK B, HONG J W K, WON Y J. Toward fine-grained traffic classification [J]. IEEE Communications Magazine, 2011, 49(7): 104-111.

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Numerical Simulation of Heat-Moisture Barrier Performance of a Horizontal Air Curtain in Cold Storage

Electrothermal Coupling Research on the Evolutionary Law of Anti-Corona Performance for High-Altitude Air-Cooled Generators

Diffusion Characteristics and Influencing Factors in Case of Hydrogen Leakage from Fuel Cell Vehicles Running in Tunnels

Sensitivity Analysis of Foil Geometrical Parameters for the Third-Generation CO2 Gas Foil Bearings Based on Design of Experiments Method

Numerical Simulation of the Energy Conversion Process in Thermoacoustic Engines with Different Stack Materials

Related Author

No data

Related Institution

No data

⁰