基于机器学习的P2P流量识别算法研究

发布时间：2018-06-07 19:07

本文选题：P2P + 流量识别　；参考：《河南理工大学》2014年硕士论文

【摘要】：P2P技术的快速发展使得P2P流量在网络流量中的比重越来越大,到目前为止,P2P流量成为网络中所占比重最大的流量,这对网络管理造成了巨大的困难,对流量监控技术提出了更高的要求。与此同时,P2P应用为了躲避检测,正在向可以随机选择端口号进行通信和对应用层数据加密的方向发展,因此,造成早期的流量识别技术对P2P流量的识别准确率降低,无法达到预期的要求,目前机器学习的方法逐渐兴起,在流量识别中的应用由于具有不依赖端口号与负载信息的优势,得到了研究界的广泛关注。本文对首先P2P技术进行了分析,包括P2P技术的定义、网络结构、特点以及应用类型,对现阶段的P2P流量识别技术进行了总结,并重点分析研究了在P2P流量识别中的机器学习算法。接下来深入研究了机器学习中的K均值与决策树算法,针对决策树模型在标签样本稀少的情况下识别准确率不高的问题,提出一种基于K均值与决策树的P2P流量识别算法。为提高K均值聚类的准确性,为决策树训练提供准确的标签样本,首先提出一种改进的K均值半监督聚类,通过用标签样本与贪心算法对初始聚类中心进行选定,然后对样本数据聚类,采用最大似然估计对聚类结果和实际网络应用类型进行匹配,提高了K均值算法的聚类性能。然后采用改进的K均值半监督聚类算法对含有大量无标签样本和少量标签样本的训练数据集进行预处理,用得到的含有大量标签样本的新训练集构建决策树分类模型。最后的实验结果表明,在标记样本较少的情况下,新算法对P2P流量的识别能力较好。
[Abstract]:The rapid development of P2P technology makes the proportion of P2P traffic in network traffic more and more large, so far, P2P traffic has become the largest volume of traffic in the network, which has caused great difficulties for network management and higher requirements for traffic monitoring technology. In the same time, P2P applications are going to be random in order to avoid detection. The port number is selected for communication and the direction of encryption of the application layer data is developed. Therefore, the early flow recognition technology reduces the recognition accuracy of the P2P traffic and can not meet the expected requirements. At present, the method of machine learning is gradually rising, and the application in traffic recognition is based on the advantages of not relying on port number and load information. This paper analyzes the first P2P technology, including the definition of P2P technology, network structure, characteristics and application types, summarizes the current P2P flow recognition technology, and focuses on the machine learning algorithm in P2P traffic identification. Then, the K in machine learning is studied in depth. In order to improve the accuracy of the K mean and the decision tree, an improved P2P mean semi supervised clustering algorithm is proposed to improve the accuracy of the K mean clustering, and a modified K mean semi supervised clustering algorithm is proposed. Class, by selecting the initial clustering center with the label sample and the greedy algorithm, then clustering the sample data, using the maximum likelihood estimation to match the clustering results and the actual network application types, the clustering performance of the K mean algorithm is improved. Then the improved K mean semi supervised clustering algorithm is used to contain a large number of unlabeled samples. The training data set is preprocessed with a small number of label samples, and a decision tree classification model is constructed with the new training set containing a large number of label samples. The final experimental results show that the new algorithm has better recognition ability for P2P traffic under the case of fewer marked samples.
【学位授予单位】：河南理工大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.06

【相似文献】