摘要
针对基于加密分组数据的网络流量分类问题,该文提出两种基于行为特征的分析方法。结合流量矩阵和网络结构熵技术,定义了出入度熵指数等参数用于描述节点间的连接行为和数据传输特征,并利用多个周期和时间尺度下的熵指数分析不同流量特征。通过可视图建网方法将流量序列转化为连接网络,利用网络结构相关参数分析流量中蕴含的节点间交互行为的差异。实验表明不同业务流量矩阵的熵指数变化趋势差别较大,而流量序列对应连接网络的聚集系数等存在明显差异。两种方法对于不同业务流量具有较好的分类效果。
Two novel methods based on hosts＇ behavior analysis are proposed for encrypted packet-based Internet traffic classification. Combined with traffic matrix and network structure entropy, some new exponents for in-degree and out-degree are introduced to illustrate the characterization of connection and message transmission among the network nodes. These exponents can be used to describe traffic feature in different periods and time scale. Visibility graph is also used to convert traffic sequence to network. And the features for network structure are utilized to analyze the host behavior in the traffic sequence. The experimental results demonstrate that the variable trend of entropy exponents and network structure for different traffic have great difference. And two proposed methods can achieve effective traffic classification.
出处
《电子与信息学报》
EI
CSCD
北大核心
2014年第9期2158-2165,共8页
Journal of Electronics & Information Technology
关键词
计算机网络
流量分类
行为特征
网络结构熵
可视图
流量矩阵
Computer network
Traffic classification
Behavior characterization
Network structure entropy
Visibility graph
Traffic matrix
