细粒度网络流量分类架构及其优化

李勋 1; 2; 唐亚哲 1

doi:10.7652/xjtuxb202011015

您当前的位置：

首页 >

文章列表页 >

细粒度网络流量分类架构及其优化

更新时间：2025-07-09

- 细粒度网络流量分类架构及其优化
- Fine-Grained Network Traffic Classification Architecture and Optimization
- 西安交通大学学报 2020年54卷第11期页码：121-128
- 作者机构：
  
  1. 西安交通大学电信学部,西安,710049
  2. 通信网信息传输与分发技术重点实验室,石家庄,050081
- 作者简介：
- 基金信息：
  
  : 2020-02-19。作者简介: 李勋(1987—),男,博士生;唐亚哲(通信作者),男,副教授。基金项目: 通信网信息传输与分发技术重点实验室开放基金资助项目(SXX18641X024)
- DOI：10.7652/xjtuxb202011015
  中图分类号： TP393.0
- 网络首发：2020-11-10，
  
  纸质出版：2020
- 稿件说明：
移动端阅览
李勋 1, 2, 唐亚哲 1. 细粒度网络流量分类架构及其优化[J]. 西安交通大学学报, 2020,54(11):121-128.

Fine-Grained Network Traffic Classification Architecture and Optimization[J]. 2020, 54(11): 121-128.
李勋 1, 2, 唐亚哲 1. 细粒度网络流量分类架构及其优化[J]. 西安交通大学学报, 2020,54(11):121-128. DOI： 10.7652/xjtuxb202011015.

Fine-Grained Network Traffic Classification Architecture and Optimization[J]. 2020, 54(11): 121-128. DOI： 10.7652/xjtuxb202011015.

摘要

针对现有网络流量指纹自动生成难度大、粒度粗及匹配阶段内存消耗大等问题

提出了细粒度网络流量分类架构及其优化。在线下

根据特定字符片段在对应流量中保持不变

且代表流量功能的有效字符片段比随机噪声片段出现的频率高这一特性

寻找流量中字符片段出现频率和长度达到一定阈值的有效片段

并将其作为备选指纹规则

通过交并、合并、指纹提纯操作获取该流量对应的指纹。在线上字符串匹配时

根据k均值分类思想重新定义距离

并利用异构位分割状态机的启发式算法对指纹中的字符串进行重新组织

对内存使用进行优化。实验结果表明:所提算法能够在未知网络流量协议格式的情况下自动生成细粒度的流量指纹

平均识别准确率为93.65%

对噪声不敏感; 在匹配时若将原所有指纹字符片段重新优化组织

当指纹规则数量在4 000以上时

可节约近50%的内存需求。

Abstract

To solve the problems of coarse-grained network traffic fingerprints and large memory consumption in the matching phase

we proposed a fine-grained network traffic classification architecture to achieve automated signature generation and optimize memory. As some portion of the data payload in a function is invariant and the signature reflecting the application function is atypical in internet traffic

the signature generation is mapped into the problem of obtaining the frequently occurring substrings and their corresponding occurrence frequency. In the case of online matching

according to the idea of k-means classification

the distance is redefined and the rules are reorganized using the heuristic heterogeneous bit-split deterministic finite automaton method to achieve the purpose of optimizing memory usage. The experimental results show that without knowing the format of the network traffic protocol

the method can automatically generate fine-grained traffic fingerprints with an average recognition accuracy of 93.65%

and is not sensitive to noise. In addition

if all fingerprint character fragments are re-optimized during matching

when the number of fingerprint rules is above 4 000

it can save nearly 50% of memory requirements compared with the previous bit-split string matching methods.

关键词

Keywords

references

ERMAN J, MAHANTI A, ARLITT M. QRP05-4: internet traffic identification using machine learning [C]∥Proceedings of the IEEE 2016 Global Telecommunications Conference. Piscataway, NJ, USA: IEEE, 2006: 1-6.

WILLIAMS N, ZANDER S, ARMITAGE G. A preliminary performance comparison of five machine learning algorithms for practical IP traffic flow classification [J]. ACM SIGCOMM Computer Communication Review, 2006, 36(5): 5-16.

徐斌. 细粒度用户级的网络流量分析与应用研究 [D]. 上海: 上海交通大学, 2013: 19-25.

YOON S H, PARK J S, KIM M S. Behavior signature for fine-grained traffic identification [J]. Applied Mathematics Information Sciences, 2015, 9(2): 523-534.

熊刚, 孟姣, 曹自刚, 等. 网络流量分类研究进展与展望 [J]. 集成技术, 2012(1): 32-42.

XIONG Gang, MENG Jiao, CAO Zigang, et al. Research progress and prospects of network traffic classification [J]. Journal of Integration Technology, 2012(1): 32-42.

BOYER R S, MOORE J S. A fast string searching algorithm [J]. Communications of the ACM, 1977, 20(10): 762-772.

ABDULLAH A, NAZIR A, SENAPAN M, et al. Fast multi-keyword range search using GPGPU [J]. GPU Computing and Applications, 2015: 259-274.

SOURDIS I, PNEVMATIKATOS D N, VASSILIADIS S. Scalable multigigabit pattern matching for packet inspection [J]. IEEE Transactions on Very Large Scale Integration(VLSI)Systems, 2008, 16(2): 156-166.

XU Kefu, QI Deyu, QIAN Zhengping, et al. Fast dynamic pattern matching for deep packet inspection [C]∥Proceedings of the 2008 IEEE International Conference on Networking, Sensing and Control. Piscataway, NJ, USA: IEEE, 2008: 802-807.

KIM H, KANG S. A pattern group partitioning for parallel string matching using a pattern grouping metric [J]. IEEE Communications Letters, 2010, 14(9): 878-880.

KIM H, CHOI K I, CHOI S I. A memory-efficient deterministic finite automaton-based bit-split string matching scheme using pattern uniqueness in deep packet inspection [J]. PLoS One, 2015, 10(5): e0126517.

AHO A V, CORASICK M J. Efficient string matching: an aid to bibliographic search [J]. Communications of the ACM, 1975, 18(6): 333-340.

LE H, PRASANNA V K. A memory-efficient and modular approach for large-scale string pattern matching [J]. IEEE Transactions on Computers, 2013, 62(5): 844-857.

HUA N, SONG H, LAKSHMAN T V. Variable-stride multi-pattern matching for scalable deep packet inspection [C]∥Proceedings of the 28th IEEE Conference on Computer Communications. Piscataway, NJ, USA: IEEE, 2009: 415-423.

PAO D, LIN W, LIU B. A memory-efficient pipelined implementation of the Aho-Corasick string-matching algorithm [J]. ACM Transactions on Architecture and Code Optimization, 2010, 7(2): 1-27.

YUN S. An efficient TCAM-based implementation of multipattern matching using covered state encoding [J]. IEEE Transactions on Computers, 2012, 61(2): 213-221.

TAN L, BROTHERTON B, SHERWOOD T. Bit-split string-matching engines for intrusion detection and prevention [J]. ACM Transactions on Architecture and Code Optimization, 2006, 3(1): 3-34.

AHO A V. Compilers: principles techniques and tools [M]. 2nd ed. New York, USA: Pearson Education Inc., 2006: 82-101.

Snort. Snort v2.8. web-client dataset [DS/OL]. [2020-01-10]. https: ∥www.snort.org/downloads/#ruledownloads.

ClamAV. ClamAV dataset [DS/OL]. [2020-01-10]. http: ∥www.clamav.net/downloads.

Suricata. Suricata dataset [DS/OL]. [2020-01-10]. https: ∥suricata-ids.org/download/.

PARK B, HONG J W K, WON Y J. Toward fine-grained traffic classification [J]. IEEE Communications Magazine, 2011, 49(7): 104-111.

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

采用机器学习的大规模并行程序I/O性能建模与预测方法

结构-语义-残差协同的图像压缩框架：面向隐私保护与高保真重建

离子液体改性燃料的电流体动力学效应研究

电子级超纯氮深冷空分流程节能优化研究

面向高海拔空冷发电机防晕性能演化规律的电热耦合研究