基于支持向量机进行流量识别的研究和实现

发布时间：2018-02-23 19:21

本文关键词： 网络流量分类支持向量机机器学习加密流量分类　出处：《北京邮电大学》2014年硕士论文　论文类型：学位论文

【摘要】：互联网上的应用数量越来越多,产生的流量越来越复杂,对网络流量的分类识别,.以提高网络的服务质量和安全性也越来越重要。本文研究了支持向量机算法、网络流量数据采集和特征生成方法、网络流量特征筛选方法,并最终实现了基于支持向量机的网络流量分类识别系统,其识别精度最高可达91%,有着一定的实用价值。本文的主要工作,取得的主要研究成果如下：着眼于不基于端口、协议和有效载荷的网络流量分类识别方法。互联网上的非传统应用大多使用了动态端口技术,数据也很少以明文格式传输,给传统的基于端口和有效载荷的网络流量分类识别方法带来了很大困难。本文基于支持向量机算法,实现了独立于端口和有效载荷的网络流量分类识别方法。提出了二十多个独立于端口和有效载荷的网络流量分类特征,并借鉴递归算法对其进行了筛选,筛选出了与分类结果相关度较高的网络流量分类特征,为支持向量机的学习和分类做了良好的铺垫。其中数据包大小的方差于P2P加密流量的有着非常高的相关性。基于交叉比对的思想和grid方法对支持向量机的参数、核函数做了系统的调节和选择,用cross validatation方法对调节后的支持向量机分类识别准确率做最合理的统计,避免了支持向量机分类准确率不稳定或统计不准确的情况。实现了基于支持向量机的流量分类识别系统,最终对于P2P加密流量的识别准确率最高可达91%,克服了传统流量识别的弊端,而且达到了相当可信的准确率,有着一定的实用价值。
[Abstract]:In order to improve the quality of service and security of the network, it is more and more important to classify and identify the network traffic because of the more and more applications on the Internet. In this paper, support vector machine (SVM) algorithm is studied. Network traffic data collection and feature generation method, network traffic feature screening method, and finally realize the support vector machine based network traffic classification and identification system. Its recognition accuracy can be up to 91 and has certain practical value. The main work of this paper and the main research results obtained are as follows:. Classification and identification of network traffic based on ports, protocols and payloads. Most of the non-traditional applications on the Internet use dynamic port technology, and data are rarely transmitted in plaintext format. It brings great difficulties to the traditional methods of network traffic classification and identification based on port and payload. Based on support vector machine (SVM) algorithm, a network traffic classification and identification method independent of port and payload is implemented in this paper. More than 20 network traffic classification features which are independent of ports and payloads are proposed, and the recursive algorithm is used to screen them, and the network traffic classification features with high correlation with classification results are selected. The variance of packet size has a high correlation with P2P encrypted traffic. Based on the idea of cross alignment and grid method, the kernel function of SVM is systematically adjusted and selected, and cross validatation method is used to make the most reasonable statistics on the accuracy of SVM classification and recognition after adjustment. The classification accuracy of SVM is not stable or the statistics are not accurate. The traffic classification and recognition system based on support vector machine is implemented. The recognition accuracy of P2P encrypted traffic is up to 91%, which overcomes the disadvantages of traditional traffic identification and achieves a very reliable accuracy. It has certain practical value.
【学位授予单位】：北京邮电大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP181;TP393.06

【相似文献】