基于马尔科夫随机场的网络流量协议识别算法的研究

发布时间：2018-05-07 09:05

本文选题：网络流量协议识别 + 神经网络　；参考：《华中科技大学》2014年硕士论文

【摘要】：传统的网络设备对各种协议一视同仁，，均分资源的服务形式己经不能满足用户的多样化需求。在这种情况下，网络服务供应商希望藉由路由器智能对待网络数据流和网络流量梯度化收费等手段在尽量不增加成本升级硬件的前提下赚取更多的网络资源使用费用，这些需求就要求网络提供商能够识别种类繁杂的数据流量。但是，由于网络服务的快速发展，网络应用协议的种类不断增加，网络协议的复杂程度也不断增长，上述问题导致了网络流量协议自动识别的困难。通过对各种应用业务的网络流量协议的分析，提出将网络会话的流量数据包头信息作为统计值的基本元素，并获得了基于网络流量统计值的特征集合。通过基于BP神经网络算法的平均影响度值评价特征对结果的影响，最终确定了最优的网络流量统计值的特征集合。然后根据目前研究的一些网络流量协议识别技术，采用基于马尔科夫随机场的隐马尔科夫模型(HMM)对网络流量进行协议识别。在设计的实验中，利用华中科技大学软件学院Intel多核实验室收集的网络通信数据集，对最优消息统计值的特征集合训练马尔科夫模型并用这些数据对训练所得模型进行测试，模型的总体准确度达到90%以上。并将得到的实验结果与其他的分类方法比较，进一步验证了论文提出的基于马尔科夫随机场的网络流量协议识别方法的优越性——准确、简单、高效。
[Abstract]:Traditional network equipments treat all kinds of protocols equally, and the service form of equally distributing resources can not meet the diverse needs of users. In this case, the network service provider hopes to earn more network resource cost without increasing the cost of upgrading the hardware by means of router intelligent treatment of network data flow and network traffic gradient charges. These requirements require network providers to identify a variety of complex data flows. However, due to the rapid development of network services, the types of network application protocols are increasing, and the complexity of network protocols is also increasing. These problems lead to the difficulties of automatic identification of network traffic protocols. Based on the analysis of network traffic protocols for various application services, the packet header information of network session traffic data is proposed as the basic element of statistical value, and the feature set based on network traffic statistics is obtained. Based on the BP neural network algorithm, the characteristic set of the optimal network traffic statistics is determined by evaluating the effect of the average influence degree value on the result. Then, according to some network traffic protocol identification techniques, the Hidden Markov Model (HMMM) based on Markov Random Field is used to identify the network traffic. In the designed experiment, using the network communication data set collected by the Intel multi-core laboratory of software school of Huazhong University of Science and Technology, the Markov model is trained by the characteristic set of the optimal message statistics, and the training model is tested with these data. The overall accuracy of the model is over 90%. By comparing the experimental results with other classification methods, the superiority of the proposed network traffic protocol recognition method based on Markov random field is further verified-accurate, simple and efficient.
【学位授予单位】：华中科技大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.06

【相似文献】