基于改进AP-SVM算法的网络流量分析与分类

发布时间：2018-02-06 05:42

本文关键词： 网络流量特征分析 AP-SVM 流量分类　出处：《南京邮电大学》2014年硕士论文　论文类型：学位论文

【摘要】：随着各种新兴应用和网络技术的大量使用，网络环境变得越来越复杂，，对网络管理提出了巨大的挑战。如何才能更好地监管网络流量和保障网络服务的QoS，准确高效对网络业务的识别和分类是前提。在基于业务流统计特征的网络业务流识别分类方法中，特征的选取是关键。本文通过对tudou视频、Skype、DOTA、QQ视频、迅雷等5种常用Internet业务进行分析，分析的主要特征有包大小分布及其统计特征、Hellinger距离、包大小平均概率及包大小转移概率、上下行包数目和字节数比例等。经过分析发现：各类业务的包大小分布较为稳定，包大小分布的均值、方差、信息熵、四分位数、峰度参数和偏度参数等统计特征均能一定程度上反映业务流包大小的特征。计算比较业务流之间包大小分布的Hellinger距离发现，tudou视频和迅雷业务包大小分布具有一定的重合，DOTA和Skype两类业务的包大小分布很相似。而这些业务在上下行包数目和字节数之比上也有着明显的区别。因而可以使用包大小、上下行包数目和字节数之比这些特征进行业务流的识别分类。最后，对现有的AP-SVM算法进行改进，提出了一种改变偏向参数（perferences）来实现更好地聚类效果的方法，以期得到更高质量、更具代表性的训练样本集，从而得到更好地分类效果。通过对网络业务流的分类实验比较，改进的算法取得了更好的分类效果。
[Abstract]:With the extensive use of a variety of emerging applications and network technology, the network environment becomes more and more complicated, a great challenge to the network management. How to better regulate the network traffic and network security services QoS, accurate and efficient of network traffic identification and classification is provided. In the flow classification statistical characteristics of traffic flow based on the network business, the selection of features is the key.
Based on the Tudou video, Skype, DOTA, QQ, video analysis, thunder and other 5 kinds of Internet business, the main feature of the analysis is packet size distribution and its statistical characteristics, Hellinger distance, average packet size and packet size probability transfer probability on the downlink packet number and node number word proportion. After analysis found: the size distribution of all kinds of business is relatively stable, the mean packet size distribution, variance, information entropy, four quantile, statistical feature parameters and skewness kurtosis feature parameters are able to reflect the degree of traffic packet size are calculated. Comparison between traffic packet size distribution Hellinger distance found, Tudou video and thunder packet size the distribution of a certain overlap, packet size distribution of DOTA and Skype two kinds of business are very similar. The packet number and the number of bytes in the uplink and downlink ratio also have obvious differences. So it can make With packet size on the downlink packet number and the ratio of the number of bytes of these features to classify the traffic flow. Finally, this paper improved the AP-SVM algorithm, the paper proposes a change bias parameter (perferences) method to achieve better clustering effect, in order to get higher quality, more representative the training sample set, to obtain better classification results. Through the experiment of network traffic classification and comparison, the improved algorithm achieved better classification results.

【学位授予单位】：南京邮电大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.06

【参考文献】