面向PCA异常检测器的毒害攻击和防御机制

网络流量异常检测对于保证网络稳定高效运行极为重要.目前基于主成分分析(PCA)的全网络异常检测算法虽然发挥了关键作用,但它还存在着受毒害攻击而失效的问题.为此,深入分析了毒害攻击的机制并对其进行了分类,提出了量化毒害流量的两个测度,并给出了3种新的毒害攻击机制;提出了一种基于健壮PCA的异常检测算法RPCA以抵御毒害攻...     

基于多分类支持向量机的P2P流量识别模型的设计

文章研究了SVM(支持向量机)在P2P流量识别中的应用技术。首先介绍了一个基于SVM的P2P流量识别方法,对网络中的P2P流量进行识别,接着对经典1-vs-all多分类SVM算法进行了改进,提出了一个新的基于MC-SVM(多分类支持向量机)的分类判别方法,用来把之前所识别出的未知具体应用层分类的P2P流量进行应用层分类,最后通过真实的网络流量数据的实验,证明了其可行性。     

基于网络流量的实时入侵检测

实时异常检测是目前网络安全的研究热点,基于大规模网络流量的统计特征,提出了一个基于统计的流量异常检测模型。根据网络流量的测度集,描绘了一个正常网络流量的基线。参照该正常流量基线,使用假设检验理论进行异常检测。采用一个基于滑动窗口的流量更新策略和感应阈控制模型,使异常检测能够更加高效。     

基于机器学习和深度学习的网络流量分类研究

随着互联网技术的不断发展以及网络规模的不断扩大,应用的类别纷繁复杂,新型应用层出不穷。为了保障用户服务质量(QoS)并确保网络安全,准确快速的流量分类是运营商及网络管理者亟须解决的问题。首先给出网络流量分类的问题定义和性能指标;然后分别介绍基于机器学习和基于深度学习的流量分类方法,分析了这些方法的优缺点,并对现存问题进行阐述;接着围绕流量分类线上部署时会遇到的3个问题:数据集问题、新应用识别问题、部署开销问题对相关工作进行阐述与分析,并进一步探讨目前网络流量分类研究面临的挑战;最后对网络流量分类下一步的研究方向进行展望。     

基于随机森林算法的网络流量分类方法

精确的网络流量分类是实现互联网可控可管的关键,传统的单一分类算法需要构建基于特定假设的某种模型,算法对于待分类数据的分布要求高,不能满足复杂多变的网络流量的分类要求。基于此,采用多决策树组合的随机森林算法实现网络流量分类。通过实际网络流量数据实验表明,在各种情况下,随机森林算法都能显著改善网络流量特别是小比例样本的分类效果,算法降低了单一算法过于依赖特定假设模型的要求,对于待分类样本的分布要求低,随机森林算法具有良好的分类效果和鲁棒性。     

一种端到端的加密流量多分类粗粒度融合算法

网络流量分类在网络安全领域发挥着重要作用,广泛应用于网络异常行为检测、网络入侵检测等研究及应用领域。随着网络加密技术的广泛使用,基于表征学习的深度学习方法由于其自动提取特征的特性,在加密流量分类领域取得了不错的性能表现。在表征学习的基础上,针对加密流量分类,提出了一种端到端的多分类粗粒度融合算法。在ISCX VPN-nonVPN数据集上的实验结果表明,所提算法与同类算法相比有更好的流量分类性能表现以及更快的收敛速度。     

基于AdaBoost的组合网络流量分类方法

针对单一分类方法在训练样本不足的情况下对于小样本网络流分类效果差的特点,通过自适应增强(Adaptive Boosting,AdaBoost)算法进行流量分类。算法首先使用CFS(Correlation-based Feature Selection)特征选择方法从大量网络流特征中提取出少量高效的分类特征,在此基础上,通过AdaBoost算法组合决策树、关联规则和贝叶斯等5种单一分类方法实现流量分类。实际网络流量数据测试表明,基于AdaBoost的组合分类方法的准确率在所选的几种算法中是最高的,其能够达到98192%,且相对于单一的分类算法,组合流量分类方法对于小样本网络流的分类效果具有明显提升。     

基于关键链路优先的光网络流量疏导保护策略

针对当前网络流量拥堵严重的问题,分析了其形成原因.提出了关键链路的概念.采用了一种基于关键链路优先的网络流量疏导保护策略.利用空闲波长的大小实现对关键链路的监控.策略性地让业务流量避开网络中的关键链路.通过NSFnet网络拓扑进行算法仿真,结果表明有较低的阻塞率.和传统算法相比,该算法可以有效降低网络流量堵塞故障.     

基于拓扑链路识别的光网络流量数据合成算法

基于深度学习的光网络流量诊断与预测等场景中,由于保密等原因,光链路的流量数据采集和存储工作受限。针对数据量少而无法支撑深度学习的问题,文章提出了一种基于拓扑链路识别的光网络流量数据合成算法,其核心思想是在生成对抗网络框架下,联合基于光网络拓扑的条件生成模型和基于光网络流量的数据合成模型,以自监督的方式合成指定光链路的流量数据。仿真结果表明,所提算法合成的光网络流量数据在自相关系数指标上与真实数据接近且使得基于全连接神经网络的流量预测模型准确率达到95%以上。     

基于云计算的海量网络流量数据分析处理及关键算法研究

为了应对日益增长的网络流量数据量和对网络安全的需求,提高网络流量数据的处理效率和准确性,文中从云计算架构出发,设计并搭建了一个能承载大规模网络流量数据处理的云计算平台。基于该平台,采用了分布式存储、并行计算和机器学习等技术,对海量网络流量数据的预处理、聚类分析、异常检测等关键环节进行了研究。结果表明,基于云计算的海量网络流量数据分析处理的关键算法取得了显著成果。通过分布式存储和并行计算技术,实现了对海量网络流量数据的高效读写和处理。在预处理阶段,针对流量数据进行采样和滤波,减少了数据量,并保留了关键特征。在聚类分析方面,利用机器学习算法实现了对网络流量的分类和统计,通过构建模型、训练和优化算法,实现了对网络攻击和异常行为的准确识别和及时报警。     

PPmcast: a novel P2P-based application-level multicast using Kamulia

The rapid growth and popularity of networked meeting environments such as video conference in recent years have spawned a series of research interests in constructing large-scale environments. For increasing scalability and decreasing the cost of management and deployment, more and more studies propose using peer-to-peer (P2P) architectures to construct large-scale application-level multicast algorithm for games, multimedia and other applications. In order to improve the applications' performance, high efficiency multicast algorithm is required. This paper focuses on developing a novel P2P application-level multicast algorithm based on Kamulia protocol. In the proposed algorithm, all nodes of P2P network are organized into structured overlay network by distributed hash table (DHT). The distance metric between two nodes is obtained by computing the exclusive or (XOR) value. The theoretical analysis indicates the proposed algorithm has better time complexity degree compared with other similar algorithms. The simulation experiments also show that the proposed algorithm has better performance on the following aspects, control expenses, loss ratio after failure, and waiting time to the first packet.     

面向类不平衡网络流量的特征选择算法

针对网络流量分类过程中出现的类不平衡问题,该文提出一种基于加权对称不确定性(WSU)和近似马尔科夫毯(AMB)的特征选择算法。首先,根据类别分布信息,定义了偏向于小类别的特征度量,使得与小类别具有强相关性的特征更容易被选择出来;其次,充分考虑特征与类别间、特征与特征之间的相关性,利用加权对称不确定性和近似马尔科夫毯删除不相关特征及冗余特征;最后,利用基于相关性度量的特征评估函数以及序列搜索算法进一步降低特征维数,确定最优特征子集。实验表明,在保证算法整体分类精确率的前提下,算法能够有效提高小类别的分类性能。     

面向类不平衡网络流量的特征选择算法

针对网络流量分类过程中出现的类不平衡问题,该文提出一种基于加权对称不确定性(WSU)和近似马尔科夫毯(AMB)的特征选择算法.首先,根据类别分布信息,定义了偏向于小类别的特征度量,使得与小类别具有强相关性的特征更容易被选择出来;其次,充分考虑特征与类别间、特征与特征之间的相关性,利用加权对称不确定性和近似马尔科夫毯删除...     

基于改进的路网聚类结合PSOWNN的交通流预测

针对城市路网交通流数据的空间相关性、非线性和平稳与非平稳的特点,提出一种采用基于交通流量数据相关性分析改进的路网聚类算法与基于交通流量分段加权适应度函数的粒子群小波神经网络算法(MC-MPSOWNN)相结合的预测方法,来提高算法的预测精度.首先,利用基于交通流量数据相关性分析的路网聚类算法筛选出空间中与预测点交通流量数据相关系数高的其他观测点,以此精简了样本输入数据,减少冗余数据对预测精度的干扰,提高整体预测精度;其次,再构建一种新型的粒子群算法的适应度函数,给予整体预测样本中非平稳数据段更大的调节力度,以此来进一步提高非平稳数据段的预测精度.最后经实验结果分析,提出的改进预测算法相比未进行改进前预测算法而言,明显提高了整体及非平稳数据段预测精度,达到较好的预测效果.     

Influence of Network Characteristics on Application Performance in a Grid Environment

In grid computing, a key issue is how limited network resources can be shared by communications by various applications more effectively in order to improve application-level performance, e.g., by reducing the completion time for an individual application and/or set of applications. Communication by an application changes the condition of the network resources, which may, in turn, affect communications by other applications, and thus may degrade their performance. In this paper, we examine the characteristics of traffic generated by typical grid applications, and the effect of the round-trip time and bottleneck bandwidth on the application-level performance (i.e., completion time) of these applications. Our experiments showed that the impact of network conditions on the performance of various applications and the impact of application traffic on network conditions differed considerably depending on the application. These results suggest that effective allocation of network resources must take into account the network-related properties of individual applications.     

High‐speed flow‐based classification on FPGA

Analyzing the composition of Internet traffic has many applications nowadays, like tracking bandwidth‐consuming applications, QoS‐based traffic engineering and lawful interception of illegal traffic. Even though many flow‐based classification methods, such as support vector machines (SVM), have demonstrated their accuracy, few practical implementations of lightweight classifiers exist. We consider in this paper the design of a real‐time SVM traffic classifier at hundreds of Gb/s to allow online detection of categories of applications. We also implement a high‐speed flow reconstruction algorithm able to handle one million concurrent flows. The solution is based on the massive parallelism and low‐level network interface access of FPGA boards. We find maximum supported bit rates up to 408 Gb/s for classification and up to 20 GB/s for flow reconstruction for the most challenging trace. Results are confirmed using a commercial Combov2 board with a Virtex 5 FPGA. Copyright © 2014 John Wiley & Sons, Ltd.     

Research of the traffic characteristics for the real time online traffic classification

Aiming at the hysteretic characteristics of classification problem existed in current internet traffic identification field,this paper investigates the traffic characteristic suitable for the on-line traffic classification,such as quality of service (QoS).By the theoretical analysis and the experimental observation,two characteristics (the ACK-Len ab and ACK-Len ba) were obtained.They are the data volume which first be sent by the communication parties continuously.For these two characteristics only depend on data’s total length of the first few packets on the flow,network traffic can be classified in the early time when the flow arrived.The experiment based on decision tree C4.5 algorithm,with above 97% accuracy.The result indicated that the characteristics proposed can commendably reflect behavior patterns of the network application,although they are simple.     

传感器网络变权组合预测流量整形算法

针对现有流量整形算法在传感器网络应用上的不足,提出了一种新的流量整形算法。分析了传感器网络流量具有突发随机性以及时变不均衡性的原因,根据传感器网络流量的模糊性、随机性以及时变性统一建模,提出了变权组合预测流量整形算法（TSAV,Traffic Shaping Algorithm with Variable weight combination forecast）,该算法通过逼近最优组合理论分配模糊AR预测与Kalman预测的组合权重,得到更为精确的预估流量值,提前规划整形速率从而平滑的输出分组流。实验表明,TSAV算法应用到传感器网络时能够准确预测流量,减少分组丢弃率的同时增大网络吞吐量,改善了传感器网络信息传输的QOS性能。      

一种高效的业务流分类算法

通过分析单链路监测的流量特征和业务流监测分析需求,提出了一种高效业务流分类算法.算法把业务流分类过程分为三个阶段:第一阶段采用Hash方法,尽量分散流记录的分布;第二阶段可采用两种方式,一种是线性链表,另一种是查找树;最后一个阶段是线性查找.分别在两种不同型号的流量监测系统上实现了该算法,实验结果显示,当链表长度为300时,查找不成功并创建新的流记录和查找成功并更新流记录的时间分别为1.8 μ s和1.3 μ s,相应的业务流分类能力为55万和77万pps.     

Network traffic classification method basing on CNN

Since the feature selection process will directly affect the accuracy of the traffic classification based on the traditional machine learning method,a traffic classification algorithm based on convolution neural network was tailored.First,the min-max normalization method was utilized to process the traffic data and map them into gray images,which would be used as the input data of convolution neural network to realize the independent feature learning.Then,an improved structure of the classical convolution neural network was proposed,and the parameters of the feature map and the full connection layer were designed to select the optimal classification model to realize the traffic classification.The tailored method can improve the classification accuracy without the complex operation of the network traffic.A series of simulation test results with the public data sets and real data sets show that compared with the traditional classification methods,the tailored convolution neural network traffic classification method can improve the accuracy and reduce the time of classification.