Skype发送模型及其应用

为了提高Skype语音流的检测效率,在分析Skype流量特征和负载特征的基础上,提出了Skype语音源的发送模型.该模型体现了Skype发送端帧结构的特征,大大简化了接收端识别的过程.     

基于UDP统计指印混合模型的VoIP流量识别方法

针对VoIP加密负载流量识别的难题,提出一种基于UDP统计指印混合模型的VoIP流量识别方法,以提高VoIP流量的识别精度和分类稳定性.该模型改进了统计指印模型中基于单一的网络流相异度来判定流量类别的方法,将UDP流的统计特征与网络流的统计指印相异度结合以共同训练一个支持向量机分类模型,把基于分类阈值点的分类转换到基于多维特征的高维空间中的分类面的分类,综合运用包层次和流层次统计特征,降低了因网络不稳定造成的统计特征偏差对分类模型精确度的影响.实验结果表明,该模型对VoIP流量的分类精确度达到97％以上,与统计指印模型和支持向量机模型相比分类稳定性更好.     

基于趋势感知协议指纹的Skype加密流量识别算法

P2P技术极大地方便了互联网上的资源共享,在网络流量中比例最大且多以加密形式出现,但存在带宽消耗大、分享内容缺乏监管等弊端。准确快速识别基于P2P架构的Skype加密流量,对于提高网络服务质量、优化网络带宽分配、加强安全管控有着重要意义。在分析Skype信令交互和内容传输阶段流量统计特征的基础上,提出一种基于趋势感知协议指纹的Skype加密流量识别算法。通过定义趋势感知加权函数,真实反映了流量特征的变化趋势;利用异常相似度,对Skype加密流量进行实时检测。实验结果表明,该方法的精确度和实时性均优于经典的协议指纹算法和C4.5等最新的加密流量识别方法。     

Skype网络流量测量及特征发现

针对越来越多P2P语音、视频传输应用给底层网络造成巨大通信压力的问题,提出Skype网络拓扑测量方案,分析Skype协议、通信机制、流量及行为特征。通过分析大量主动获取的节点数据和被动获取的Skype通信流量,总结出Skype网络的通信机制,发现部分Skype网络的流量特征、协议行为特征,经测试,在局域网环境下,该项方案能有效识别、管理Skype流量。     

基于自编码器的网络游戏流量分类

加密和动态端口技术使传统的流量分类技术不能满足网络游戏识别的性能需求, 本文提出了一种基于自编码器降维的端到端流量分类模型, 实现网络游戏流量的准确识别. 首先将原始流量预处理成784 B的一维会话流向量, 利用编码器进行无监督降维, 去除无效特征; 接着探索构建卷积神经网络与LSTM网络并联算法, 对降维后的样本进行空间和时序特征的提取和融合, 最后利用融合特征进行分类. 在自建的游戏流量数据集和公开数据集上测试, 本文模型在网络游戏流量识别方面达到了97.68%的准确率; 与传统端到端的网络流量分类模型相比, 本文所设计的模型更加轻量化, 具有实用性, 并且能够在资源有限的设备中方便部署.     

带背景流的P2P流量识别技术研究

针对P2P(peer-to-peer,对等体网络)应用系统中对等体主机的行为特征与P2P业务流量特征多样化、复杂化,使得单纯利用一种典型特征的P2P流量分类技术的识别精度不高的问题,提出了一种新的P2P流量多阶段识别方法;该方法根据P2P应用流量的一系列固有特征,可以从聚合网络流中识别P2P流量;通过实验表明,该方法P2P流识别精度可达99.7%,同时错误分类精度0.3%。     

基于流量统计的 P2P 网络关键节点识别

针对当前 P2P（peer-to-peer）网络普遍存在关键节点的现状,为了准确地识别 P2P 网络中的关键节点,通过分析关键节点的相应特点,提出了一种基于网络流量的 P2P 关键节点识别方法。通过提取网络流的空间特征等特性作为关键节点识别的依据,并以 Skype 作为研究对象,采用真实的流量数据进行验证测试。实验表明,该方法能够准确地识别出 Skype 网络中的关键节点,识别准确率较高,而且实时性较好。     

一种组合式特征选择算法及其在网络流量识别中的应用

当前网络流量日趋复杂,给网络管理带来许多困难.为了准确地识别出网络中的各种流量,本文以支持向量机为分类器,以流的统计学特征为分类依据,提出一种组合式特征选择算法,该算法首先快速去除和分类不相关的特征,针对余下的特征,再利用遗传算法引导特征的选择和支持向量机模型参数的寻优,最终获得了最优的特征集和最佳的支持向量机分类模型.经过实验验证,基于该算法的网络流量识别方法在识别P2P流量时能以更少的特征获得更高的分类准确率.     

天地一体化智能网络流量实时分类

天地一体化智能网络规模大,环境复杂,网络中流量业务类型繁多且流量具有突发性.本文结合Spark大数据分布式平台,根据流量的特点设计了SFFS-FCBF-C4.5(简称SFC)决策树分类模型,实现了大规模网络下流量的实时分类,以保障网络中资源的合理分配和利用.SFC算法是在C4.5决策树算法的基础上结合了改进后的快速相关滤波算法(Fast Correlation-Based Filter Solution, FCBF)和连续型属性值离散化算法,可以在有效去除冗余特征和降低模型复杂度的同时,提高模型分类的速度和准确率.仿真结果表明,SFC决策树分类模型相比传统的流量分类模型具有较好的稳定性和较高的准确率,可以很好的适应复杂多变的网络环境.同时,Spark大数据分布式平台的应用大幅度提高了大规模网络下流量分类的速度,能够对海量流量进行实时分类.     

Internet流分类方法的比较研究

Internet流分类是网络测量、流量监控中的一个重要环节.本文分析了几种典型的流分类方法：基于特定端口号、基于应用层特征字段和基于传输层的方法,其中第二种方法专门用于识别当前日益增多的对等网络应用流量.从准确性、完整性、实时性以及可扩展性等方面对这三种方法进行了比较,分别指出它们的优势和不足.最后提出了一种实用型流分类方案,并对流分类领域的发展提出了看法.     

一种基于行为模式的Skype流量识别方法

Skype是一种基于P2P技术的VoIP客户端,其通讯协议不公开,且通讯内容加密,因此对Skype的流量识别不能采用传统的端口识别法及特征字检测法。首先对Skype的通信机制进行深入的探讨,并通过实际的数据包分析总结出Skype流量的行为模式,最后设计并实现了相应的识别模块对结论进行验证。     

Detailed Analysis of Skype Traffic

Skype is beyond any doubt the VoIP application in the current Internet application spectrum. Its amazing success has drawn the attention of telecom operators and the research community, both interested in knowing its internal mechanisms, characterizing its traffic, understanding its users' behavior. In this paper, we investigate the characteristics of traffic streams generated by voice and video communications, and the signaling traffic generated by Skype. Our approach is twofold, as we make use of both active and passive measurement techniques to gather a deep understanding on the traffic Skype generates. From extensive testbed experiments, we devise a source model which takes into account: i) the service type, i.e., SkypeOut calls or calls between two Skype clients, ii) the selected source Codec, iii) the adopted transport layer protocol, and iv) network conditions. Leveraging on the use of an accurate Skype classification engine that we recently proposed, we study and characterize Skype traffic based on extensive passive measurements collected from our campus LAN.     

基于流量特征和载荷特征的P2P流量识别

本文分析了目前的P2P网络流量识别方法及其存在的问题。设计识别P2P流量的数据结构;在流量识别阶段,在传输层捕获TCP和UDP数据包,依据P2P流在传输层表现出来的主要流量特征,进行TCP/UDP流量特征的P2P流量识别;在载荷特征识别阶段,对载荷特征库定期更新,将在流量识别阶段中识别出的P2P流作精确载荷特征识别,并将流量识别阶段中漏掉的流量作载荷特征识别;在模式匹配过程采用比较指印函数值来加快识别速度;进而提出一个可准确识别出新生、加密的P2P流量及其名称的算法。实验结果表明,该算法具有较高识别和分类P2P流量的能力。     

Understanding Skype signaling

Skype is without a doubt today’s VoIP application of choice. Its amazing success has drawn the attention of both telecom operators and the research community. There is a great interest in characterizing Skype’s traffic, understanding its internal mechanisms, and learning about its users’ behavior. One of the most interesting characteristics of Skype is that it relies on a P2P infrastructure for the exchange of signaling information that is distributed between peers.Leveraging the use of an accurate Skype classification engine that we recently designed, we now report the results of our experimental study of Skype signaling based on extensive passive measurements collected from our campus LAN. We avoid the need to reverse-engineer the Skype protocol, and we instead adopt a black-box approach. We focus on signaling traffic in order to infer certain interesting properties regarding overlay maintenance and, possibly, the overlay structure as well.Our results show that, even though the signaling bandwidth used by normal peers is exiguous, it may nonetheless account for a significant portion of the total traffic generated by a single Skype client. Skype performs peer discovery and refresh by using a large number of single packet probes. This may be as effective for the purpose of overlay maintenance as it is costly, at least from the viewpoint of layer-4 network devices. At the same time, single-packet probes account for only a minor fraction of all signaling traffic: therefore, we wish to explore more deeply the traffic that is exchanged among the more stable peers, in an attempt to learn how the peer selection mechanism actually operates.Measurements were collected during April and August 2007. In particular, during the second month of sampling, the Skype network suffered a worldwide service outage. We compare the results collected during the two time periods, and we demonstrate the striking impacts on the signaling network as a result of the outage.     

Traffic analysis attacks on Skype VoIP calls

Skype is one of the most popular voice-over-IP (VoIP) service providers. One of the main reasons for the popularity of Skype VoIP services is its unique set of features to protect privacy of VoIP calls such as strong encryption, proprietary protocols, unknown codecs, dynamic path selection, and the constant packet rate. In this paper, we propose a class of passive traffic analysis attacks to compromise privacy of Skype VoIP calls. The proposed attacks are based on application-level features extracted from VoIP call traces. The proposed attacks are evaluated by extensive experiments over different types of networks including commercialized anonymity networks and our campus network. The experiment results show that the proposed traffic analysis attacks can greatly compromise the privacy of Skype calls. Possible countermeasure to mitigate the proposed traffic analysis attacks are analyzed in this paper.     

On Metrics to Distinguish Skype Flows from HTTP Traffic

Skype is a Voice over IP (VoIP) Internet application that is gaining huge popularity in recent years. A key point to Skype popularity is its capability to dynamically adapt itself to operate behind firewalls or network proxies. A common way adopted by Skype to delude these network devices is to use port 80, normally expected to comprise HTTP traffic. In this paper, we propose metrics and investigate statistical tests intended to clearly distinguish Skype flows from HTTP traffic. We validate our study using real-world experimental datasets gathered at a commercial Internet Service Provider (ISP). Our experimental results suggest that the proposed methodology may be seen as a promising building block towards a system to detect general protocol anomalies in HTTP traffic.     

区分交通流模式的混合服务路口信号控制策略

相对于固定配时,基于交通流的动态变化特征的信号配时算法具有更好的道路状态适应性.鉴于此,提出一种基于交通流识别的自适应控制策略,首先利用自组织映射网络(SOM)神经网络对历史交通流状态聚类,结合路口时间段与路段环境特征分析实现交通流模式划分;在此基础上,引入概率神经网络(PNN)对该路口的交通流模式进行训练学习;最后针对不同状态类型交通流量,动态选取门限服务轮询信号配时和韦伯斯特信号配时策略计算信号灯配时周期,实现控制策略与交通流动态变化特征的匹配.仿真实验结果表明,区分交通流模式的混合服务路口信号控制方法对车流的随机变化具有更好的适应性.     

基于行为特征描述的P2P流识别方法的研究

提出了一种基于行为特征描述的P2P流识别算法(BCCIA).首先建立了基于行为特征描述的P2P流的规范化统一描述,并定义了关键字的文法规则.接着,在BCCIA算法中,采用基于均匀分布的Hash函数来实现匹配和加快匹配速度,并详细阐述了模式识别的具体实现步骤.最后,在Linux环境下,以Skype为例进行仿真试验.实验数据表明,采用BCCIA算法,可以很好地实现分类和标识P2P流.