Method of data cleaning for network traffic classification

Network traffic classification aims at identifying the application types of network packets. It is important for Internet service providers （ISPs） to manage bandwidth resources and ensure the quality of service for different network applications However, most classification techniques using machine learning only focus on high flow accuracy and ignore byte accuracy. The classifier would obtain low classification performance for elephant flows as the imbalance between elephant flows and mice flows on Internet. The elephant flows, however, consume much more bandwidth than mice flows. When the classifier is deployed for traffic policing, the network management system cannot penalize elephant flows and avoid network congestion effectively. This article explores the factors related to low byte accuracy, and secondly, it presents a new traffic classification method to improve byte accuracy at the aid of data cleaning. Experiments are carried out on three groups of real-world traffic datasets, and the method is compared with existing work on the performance of improving byte accuracy. Experiment shows that byte accuracy increased by about 22.31% on average. The method outperforms the existing one in most cases.     

基于行为特征学习的互联网流量分类方法

基于连接图的互联网流量分类方法能反映主机间的通信行为,具有较高的分类稳定性,但是经验式总结的启发式规则有限,难以获得高分类准确率.研究分析了主机间通信行为模式和BOF方法,从具有相同{目的IP地址,目的端口号,传输层协议}网络流量中,提取主机间连接相关的行为统计特征(HCBF),采用C4.5决策树算法学习基于行为特征的分类规则,其无需人工建立启发式规则.在传统互联网和移动互联网流量数据集上,从基本分类性能和分类稳定性方面,与现有的特征集进行比较分析,实验结果表明,HCBF特征集合的类间区分能力和稳定性较高.     

Studying cost-sensitive learning for multi-class imbalance in Internet traffic classification

Cost-sensitive learning has been applied to resolve the multi-class imbalance problem in Internet traffic classification and it has achieved considerable results.But the classification performance on the minority classes with a few bytes is still unhopeful because the existing research only focuses on the classes with a large amount of bytes.Therefore,the class-dependent misclassification cost is studied.Firstly,the flow rate based cost matrix(FCM) is investigated.Secondly,a new cost matrix named weighted cost matrix(WCM) is proposed,which calculates a reasonable weight for each cost of FCM by regarding the data imbalance degree and classification accuracy of each class.It is able to further improve the classification performance on the difficult minority class(the class with more flows but worse classification accuracy).Experimental results on twelve real traffic datasets show that FCM and WCM obtain more than 92% flow g-mean and 80% byte g-mean on average;on the test set collected one year later,WCM outperforms FCM in terms of stability.     

基于机器学习和深度学习的网络流量分类研究

随着互联网技术的不断发展以及网络规模的不断扩大,应用的类别纷繁复杂,新型应用层出不穷。为了保障用户服务质量(QoS)并确保网络安全,准确快速的流量分类是运营商及网络管理者亟须解决的问题。首先给出网络流量分类的问题定义和性能指标;然后分别介绍基于机器学习和基于深度学习的流量分类方法,分析了这些方法的优缺点,并对现存问题进行阐述;接着围绕流量分类线上部署时会遇到的3个问题:数据集问题、新应用识别问题、部署开销问题对相关工作进行阐述与分析,并进一步探讨目前网络流量分类研究面临的挑战;最后对网络流量分类下一步的研究方向进行展望。     

一种面向LTE-V2X的联邦学习信道估计算法

基于深度学习的信道估计方法中,训练网络模型需要大量的数据运算,且所有用户数据都需要集中上传至服务器上,存在隐私泄漏的隐患.针对上述问题,提出了一种基于联邦学习的LTE-V2X(Long Term Evolution-Vehicle to Everything)信道估计算法,采用CNN-LSTM-DNN(Convolutional Neural Network-Long Short Term Memory-Deep Neural Network)模型对时变的信道进行估计,并将学习网络模型所需要的计算分配到车载用户中,在降低道旁基站负载的同时也保护了车载用户数据的隐私.仿真结果表明,基于联邦学习的信道估计算法在车载用户高速移动的场景下,较传统的信道估计算法平均有10 dB以上的归一化均方误差(Normalized Mean Square Error,NMSE)增益以及3 dB以上的误码率(Bit Error Rate,BER)增益,且较集中式学习算法相比,NMSE性能差距在3 dB以内;BER性能差距在1 dB以内,所提算法能够有效追踪时变的信道,且与集中式学习算法相比仅损失了极少的性能.     

红外目标检测网络改进半监督迁移学习方法

针对红外数据集规模小,标记样本少的特点,提出了一种红外目标检测网络的半监督迁移学习方法,主要用于提高目标检测网络在小样本红外数据集上的训练效率和泛化能力,提高深度学习模型在训练样本较少的红外目标检测等场景当中的适应性。文中首先阐述了在标注样本较少时无标注样本对提高模型泛化能力、抑制过拟合方面的作用。然后提出了红外目标检测网络的半监督迁移学习流程:在大量的RGB图像数据集中训练预训练模型,后使用少量的有标注红外图像和无标注红外图像对网络进行半监督学习调优。另外,文中提出了一种特征相似度加权的伪监督损失函数,使用同一批次样本的预测结果相互作为标注,以充分利用无标注图像内相似目标的特征分布信息;为降低半监督训练的计算量,在伪监督损失函数的计算中,各目标仅将其特征向量邻域范围内的预测目标作为伪标注。实验结果表明,文中方法所训练的目标检测网络的测试准确率高于监督迁移学习所获得的网络,其在Faster R-CNN上实现了1.1%的提升,而在YOLO-v3上实现了4.8%的显著提升,验证了所提出方法的有效性。     

基于隐含信息的半监督学习方法研究

Implicit information semi supervised learning algorithm was studied.The implicit information semi supervised learning algorithm was used in support vector machine and random forest,which were called semi-SVM and semi-RF.The semi-SVM and semi-RF were evaluated by using UCI,the experimental results show that the semi-SVM and semi-RF are more effective and more precise.The semi-SVM and semi-RF were applied to classifying lung sounds,and verified the effect by using the actual lung sounds data.the quantity and quality of samples affect semi-SVM and semi-RF were analyzed.     

Towards asynchronous federated learning for heterogeneous edge-powered internet of things

The advancement of the Internet of Things (IoT) brings new opportunities for collecting real-time data and deploying machine learning models. Nonetheless, an individual IoT device may not have adequate computing resources to train and deploy an entire learning model. At the same time, transmitting continuous real-time data to a central server with high computing resource incurs enormous communication costs and raises issues in data security and privacy. Federated learning, a distributed machine learning framework, is a promising solution to train machine learning models with resource-limited devices and edge servers. Yet, the majority of existing works assume an impractically synchronous parameter update manner with homogeneous IoT nodes under stable communication connections. In this paper, we develop an asynchronous federated learning scheme to improve training efficiency for heterogeneous IoT devices under unstable communication network. Particularly, we formulate an asynchronous federated learning model and develop a lightweight node selection algorithm to carry out learning tasks effectively. The proposed algorithm iteratively selects heterogeneous IoT nodes to participate in the global learning aggregation while considering their local computing resource and communication condition. Extensive experimental results demonstrate that our proposed asynchronous federated learning scheme outperforms the state-of-the-art schemes in various settings on independent and identically distributed (i.i.d.) and non-i.i.d. data distribution.     

Indoor localization via -graph regularized semi-supervised manifold learning

In this paper,a new l1-graph regularized semi-supervised manifold learning(LRSML) method is proposed for indoor localization.Due to noise corruption and non-linearity of received signal strength(RSS),traditional approaches always fail to deliver accurate positioning results.The l1-graph is constructed by sparse representation of each sample with respect to remaining samples.Noise factor is considered in the construction process of l1-graph,leading to more robustness compared to traditional k-nearest-neighbor graph(KNN-graph).The KNN-graph construction is supervised,while the l1-graph is assumed to be unsupervised without harnessing any data label information and uncovers the underlying sparse relationship of each data.Combining KNN-graph and l1-graph,both labeled and unlabeled information are utilized,so the LRSML method has the potential to convey more discriminative information compared to conventional methods.To overcome the non-linearity of RSS,kernel-based manifold learning method(K-LRSML) is employed through mapping the original signal data to a higher dimension Hilbert space.The efficiency and superiority of LRSML over current state of art methods are verified with extensive experiments on real data.     

一种稳定的基于极端学习机的纹理分类方法

针对传统基于极端学习机(ELM)的纹理分类方 法容易出现输出不稳定的缺点,本文将线性和非线 性模型进行融合,改进了传统动力学模型。利用ELM能够快速学习的特点,将其作为基分类 器,同时利用 线性吸引子和局部吸引子的迭代,实现多个ELM分类器的最佳融合,以提升学习模型的泛 化能力和稳定 性。利用动力模型实现多分类器的融合有助于寻求多个基分类器之间的一致性,摒弃了基分 类器中判别错 误的样本输出。通过对CUReT纹理数据库的分类结果,与传统纹理分类方法相 比,本文算法的稳定性 和分类准确率都得到了一定程度的提升,取得了理想的分类效果。     

A blockchain-based audit approach for encrypted data in federated learning

The development of data-driven artificial intelligence technology has given birth to a variety of big data applications. Data has become an essential factor to improve these applications. Federated learning, a privacy-preserving machine learning method, is proposed to leverage data from different data owners. It is typically used in conjunction with cryptographic methods, in which data owners train the global model by sharing encrypted model updates. However, data encryption makes it difficult to identify the quality of these model updates. Malicious data owners may launch attacks such as data poisoning and free-riding. To defend against such attacks, it is necessary to find an approach to audit encrypted model updates. In this paper, we propose a blockchain-based audit approach for encrypted gradients. It uses a behavior chain to record the encrypted gradients from data owners, and an audit chain to evaluate the gradients’ quality. Specifically, we propose a privacy-preserving homomorphic noise mechanism in which the noise of each gradient sums to zero after aggregation, ensuring the availability of aggregated gradient. In addition, we design a joint audit algorithm that can locate malicious data owners without decrypting individual gradients. Through security analysis and experimental evaluation, we demonstrate that our approach can defend against malicious gradient attacks in federated learning.     

Network traffic classification method basing on CNN

Since the feature selection process will directly affect the accuracy of the traffic classification based on the traditional machine learning method,a traffic classification algorithm based on convolution neural network was tailored.First,the min-max normalization method was utilized to process the traffic data and map them into gray images,which would be used as the input data of convolution neural network to realize the independent feature learning.Then,an improved structure of the classical convolution neural network was proposed,and the parameters of the feature map and the full connection layer were designed to select the optimal classification model to realize the traffic classification.The tailored method can improve the classification accuracy without the complex operation of the network traffic.A series of simulation test results with the public data sets and real data sets show that compared with the traditional classification methods,the tailored convolution neural network traffic classification method can improve the accuracy and reduce the time of classification.     

基于可变特征空间SVM的互联网流量分类

支持向量机（support vector machine,SVM）是一类具有良好泛化能力的机器学习算法,适合应用于互联网动态环境下的流量分类问题。目前将SVM扩展到流量分类这样的多分类问题的方法主要有One-Against-All和One-Against-One方法。这些方法都基于单一的特征空间训练SVM两分类器,没有考虑到不同特征对不同流量类的不同区分能力,因此获得的分离超平面并不是最合理的。为此提出了可变特征空间的SVM集成方法,即为每个两分类 SVM 构建具有最优区分能力的独立特征空间,单独训练两分类 SVM,最后再利用One-Against-All和One-Against-One方法集成为多分类器。实验表明,与原来的单一特征空间的One-Against-All和One-Against-One集成方法相比,提出的方法能有效提高流量分类器分类精度和召回率,更易获得最优分离超平面。     

Semi-supervised internet network traffic classification using a Gaussian mixture model

With a dramatic increase in the number and variety of applications running over the internet, it is very important to be capable of dynamically identifying and classifying flows/traffic according to their network applications. Meanwhile, internet application classification is fundamental to numerous network activities. In this paper, we present a novel methodology for identifying different internet applications. The major contributions are: (1) we propose a Gaussian mixture model (GMM)-based semi-supervised classification system to identify different internet applications; (2) we achieve an optimum configuration for the GMM-based semi-supervised classification system. The effectiveness of these proposed approaches is demonstrated through experimental results.     

基于活跃熵的网络异常流量检测方法

提出了一种基于活跃熵的网络异常流量检测新方法,将受监控的目标网络视为一个整体系统,对进出系统的网络数据流所形成的NetFlow记录进行分析,分别统计二者的活跃度并计算它们的活跃熵。在进行活跃熵的计算时,根据流量大小选择不同的尺度来降低误报率,从而能更有效地检测网络流量中存在的异常。在实际网络环境下的模拟实验结果表明,与传统检测方案相比,基于活跃熵的网络异常流量检测方法能够更有效地检测出具有随机特征的网络异常流量。     

基于AdaBoost的组合网络流量分类方法

针对单一分类方法在训练样本不足的情况下对于小样本网络流分类效果差的特点,通过自适应增强(Adaptive Boosting,AdaBoost)算法进行流量分类。算法首先使用CFS(Correlation-based Feature Selection)特征选择方法从大量网络流特征中提取出少量高效的分类特征,在此基础上,通过AdaBoost算法组合决策树、关联规则和贝叶斯等5种单一分类方法实现流量分类。实际网络流量数据测试表明,基于AdaBoost的组合分类方法的准确率在所选的几种算法中是最高的,其能够达到98192%,且相对于单一的分类算法,组合流量分类方法对于小样本网络流的分类效果具有明显提升。     

Research of the traffic characteristics for the real time online traffic classification

Aiming at the hysteretic characteristics of classification problem existed in current internet traffic identification field,this paper investigates the traffic characteristic suitable for the on-line traffic classification,such as quality of service (QoS).By the theoretical analysis and the experimental observation,two characteristics (the ACK-Len ab and ACK-Len ba) were obtained.They are the data volume which first be sent by the communication parties continuously.For these two characteristics only depend on data’s total length of the first few packets on the flow,network traffic can be classified in the early time when the flow arrived.The experiment based on decision tree C4.5 algorithm,with above 97% accuracy.The result indicated that the characteristics proposed can commendably reflect behavior patterns of the network application,although they are simple.     

FlowAntEater: network traffic automatic signature generator

In the areas of traffic classification, the payload signature-based classification method–deep packet inspection (DPI) shows the highest performance in terms of preciseness, reliability and practicality. The usual way, however, obtaining signatures for DPI is analyzing network traffic payload and find signatures by hand, which means inefficient and a heavy burden for researchers. Therefore, the research on network traffic automatic signatures generation (NTASG), which helps administrators and researcher find network signatures, becomes important. In this paper, a software framework on NTASG is proposed which uses the K-means cluster algorithm to purity the traffic flow and contains a systematic signatures management algorithm, sig-tree. Also, the feasibility of our design choices was proved via experimental evaluation on the campus traffic trace.