PPP： Towards Parallel Protocol Parsing

Network traffic classification plays an important role and benefits many practical network issues, such as Next-Generation Firewalls （NGFW）, Quality of Service （QoS）, etc. To face the challenges brought by modern high speed networks, many inspiring solutions have been proposed to enhance traffic classification. However, taking many factual network conditions into consideration, e.g., diversity of network environment, traffic classification methods based on Deep Inspection （DI） technique still occupy the top spot in actual usage. In this paper, we propose a novel classification system employing Deep Inspection technique, aiming to achieve Parallel Protocol Parsing （PPP）. We start with an analytical study of the existing popular DI methods, namely, regular expression based methods and protocol parsing based methods. Motivated by their relative merits, we extend traditional protocol parsers to achieve parallel matching, which is the representative merit of regular expression. We build a prototype system, and evaluation results show that significant improvement has been made comparing to existing open-source solutions in terms of both memory usage and throughput.     

Studying cost-sensitive learning for multi-class imbalance in Internet traffic classification

Cost-sensitive learning has been applied to resolve the multi-class imbalance problem in Internet traffic classification and it has achieved considerable results.But the classification performance on the minority classes with a few bytes is still unhopeful because the existing research only focuses on the classes with a large amount of bytes.Therefore,the class-dependent misclassification cost is studied.Firstly,the flow rate based cost matrix(FCM) is investigated.Secondly,a new cost matrix named weighted cost matrix(WCM) is proposed,which calculates a reasonable weight for each cost of FCM by regarding the data imbalance degree and classification accuracy of each class.It is able to further improve the classification performance on the difficult minority class(the class with more flows but worse classification accuracy).Experimental results on twelve real traffic datasets show that FCM and WCM obtain more than 92% flow g-mean and 80% byte g-mean on average;on the test set collected one year later,WCM outperforms FCM in terms of stability.     

Identifying file-sharing P2P traffic based on traffic characteristics

This article focuses on identifying file-sharing peer-to-peer （P2P） （such as BitTorrent （BT）） traffic at the borders of a stub network. By analyzing protocols and traffic of applications, it is found that file-sharing P2P traffic of a single user differs greatly from traditional and other P2P （such as QQ） applications＇ traffic in the distribution of involved remote hosts and remote ports. Therefore, a method based on discreteness of remote hosts （RHD） and discreteness of remote ports （RPD） is proposed to identify BT-like traffic. This method only relies on flow information of each user host in a stub network, and no packet payload needs to be monitored. At intervals, instant RHD for concurrent transmission control protocol and user datagram protocol flows for each host are calculated respectively through grouping flows by the stub network that the remote host of each flow belongs to. On given conditions, instant RPD are calculated through grouping flows by the remote port to amend instant RHD. Whether a host has been using a BT-like application or not can be deduced from instant RHD or average RHD for a period of time. The proposed method based on traffic characteristics is more suitable for identifying protean file-sharing P2P traffic than content-based methods Experimental results show that this method is effective with high accuracy.     

Method of data cleaning for network traffic classification

Network traffic classification aims at identifying the application types of network packets. It is important for Internet service providers （ISPs） to manage bandwidth resources and ensure the quality of service for different network applications However, most classification techniques using machine learning only focus on high flow accuracy and ignore byte accuracy. The classifier would obtain low classification performance for elephant flows as the imbalance between elephant flows and mice flows on Internet. The elephant flows, however, consume much more bandwidth than mice flows. When the classifier is deployed for traffic policing, the network management system cannot penalize elephant flows and avoid network congestion effectively. This article explores the factors related to low byte accuracy, and secondly, it presents a new traffic classification method to improve byte accuracy at the aid of data cleaning. Experiments are carried out on three groups of real-world traffic datasets, and the method is compared with existing work on the performance of improving byte accuracy. Experiment shows that byte accuracy increased by about 22.31% on average. The method outperforms the existing one in most cases.     

Network Traffic Clustering with QoS-Awareness

Network traffic classification is essential in supporting network measurement and management.Many existing traffic classification approaches provide application-level results regardless of the network quality of service(QoS) requirements. In practice,traffic flows from the same application may have irregular network behaviors that should be identified to various QoS classes for best network resource management. To address the issues, we propose to conduct traffic classification with two newly de...     

Encrypted traffic classification based on fusion of vision transformer and temporal features

Aiming at the problem that the current encrypted traffic classification methods only use the single network framework such as convolutional neural network(CNN), recurrent neural network(RNN), and stacked autoencoder(SAE), and only construct a shallow network to extract features, which leads to the low accuracy of encrypted traffic classification, an encrypted traffic classification framework based on the fusion of vision transformer and temporal features was proposed. Bottleneck transformer netw...     

Research on Traffic Identification Technologies for Peer-to-Peer Networks

The Peer-to-Peer(P2P)network traffic identification technology includes Transport Layer Identification(TLI)and Deep Packet Inspection(DPI)methods.By analyzing packets of the transport layer and the traffic characteristic in the P2P system,TLI can identify whether or not the network data flow belongs to the P2P system.The DPI method adopts protocol analysis technology and reverting technology.It picks up data from the P2P application layer and analyzes the characteristics of the payload to judge if the network traffic belongs to P2P applications.Due to its accuracy,robustness and classifying ability,DPI is the main method used to identify P2P traffic.Adopting the advantages of TLI and DPI,a precise and efficient technology for P2P network traffic identification can be designed.     

Performance Modeling of the Fast and Reliable Two-Layer Retransmission for CDMA Systems

1　Introduction　With the proliferation of the World Wide Web (WWW)in our daily life, a number of wireless data services[1] suchas voice, audio, video streaming, file and web downloadingalso need to be supported in the wireless access networks.To bring the WWW traffic to the wireless mobile devices, itis important that a suitable protocol or standard is chosen tocater to the growing demands of data services over wirelesschannels which could handle a wide variety of multimediatraffic with …     

基于多级分类的网络流量在线识别方法(英文)

Internet traffic classification plays an important role in network management. Many approaches have been proposed to classify different categories of Internet traffic. However, these approaches have specific usage contexts that restrict their ability when they are applied in the current network environment. For example, the port based approach cannot identify network applications with dynamic ports; the deep packet inspection approach is invalid for encrypted network applications; and the statistical based approach is time-consuming. In this paper, a novel technique is proposed to classify different categories of network applications. The port based, deep packet inspection based and statistical based approaches are integrated as a multistage classifier. The experimental results demonstrate that this approach has high recognition rate which is up to 98% and good performance of real-time for traffic identification.     

Progress of Internet Video Technology

In China, currently there are more than 100 million videos being watched everyday on the Internet. There are three kinds of Internet videos: video sharing, Video on Demand (VoD), and Peer-to-Peer (P2P) streaming media. Video sharing is based on browser/server mode, severing user generated content. VoD is based on client/server mode and needs to be paid for. P2P streaming media is based on P2P mode service for hot content. To address P2P traffic optimization and content regulation, China National Information Technology Standardization Technical Committee sets up P2P working group to make relevant standards.     

P2P网络聚合流量识别技术研究

对等体网络P2P（Peer-to-Peer）应用系统中对等体主机的行为特征与P2P业务流量特征多样化、复杂化,使得单纯利用一种典型特征的P2P流量分类技术的识别精度不高。文中提出了一种新的P2P流量多阶段识别方法,该方法根据P2P应用流量的一系列固有特征,可以从聚合网络流中识别P2P流量。通过实验表明,丈中所提出的方法P2P流识别精度可达99．7％,同时错误分类精度0．3％。     

基于UDP流量的P2P流媒体流量识别算法研究

以几款主流的P2P流媒体网络电视作为研究对象,深入分析了其产生的流量在端口使用方面的特点和报文长度分布上的差异。通过对这些特征的总结和提取,获得了基于端口特性“在一次交互过程中,特定主机的特定端口唯一确定一种应用”等结论。在此基础上提出了一种基于带有扩展属性的流记录准确识别P2P应用UDP流量的EXID算法。通过对CERNET江苏省边界10G主干信道上采集的Trace数据中5种P2P流媒体应用进行识别,并与机器学习流量识别算法进行比较,其结果表明提出的方案具有很高的查准率和查全率,时间效率高,且不易受样本比重的影响。     

Timely traffic identification on P2P streaming media

Since the year of 2006,peer-to-peer (P2P) streaming media service has been developing rapidly,the user scale and income scale achieve synchronous growth.However,while people enjoying the benefits of th...     

P2P流媒体网络电视通信机制研究

近年来兴起的P2P流媒体网络电视成为了Internet上的一种主要应用,分析和研究P2P流媒体系统对于识别其流量和日后开发类似的系统具有很强的指导意义.本文选取PPStream和QQLive两款常用软件通过抓取其流量数据进行协议分析,主要关注系统获取节点列表、资源交换和数据传输等实现方法,进而总结出了一套P2P流媒体协议分析框架,提出了一种基于协议分析的流量识别方法.     

P2P流媒体业务技术分析与设计

基于对等网络(P2P)模式的业务和应用给传统互联网带来了巨大的影响,如何更有效地利用P2P技术来发展新的增值业务,是P2P业务开展各方迫切需要解决的问题。新兴P2P流媒体运营商、主流数字媒体运营商、电信运营商业务实现方案及部署思路各不相同。对于电信运营商,目前网络上P2P应用最成熟的模式为P2P直播,初期开展业务容易,用户接受程度较高。建议运营商结合自身的带宽资源对业务流量采用"疏"、"堵"、"用"相结合的手段,先期实现P2P直播业务,逐步尝试开展P2P下载和点播业务,同时加强P2P流媒体业务的安全保障系统方案及开展该业务可能的盈利模式的研究,使P2P流媒体业务成为的电信运营商转型和发展的重要支撑业务。     

基于多尺度分析和决策树的P2P流量检测模型

P2P流量的检测和管控是随着P2P技术应用变化而不断发展的,传统的P2P流量检测技术的局限性越来越明显,导致各种新的P2P流量检测技术成为当前研究热点.首先介绍了传统的P2P流量检测技术以及其存在的缺陷,然后重点提出了用于检测网络层数据包的多尺度分析模型.多尺度分析模型通过提取疑似P2P流量可以缩小P2P流量的检测范围,提高P2P流量的检测效率,提高P2P流量检测效率,并且结合决策树对疑似P2P流量进行协议分析达到有效识别和分类的目的.最后提出了P2P网络流量监管未来的研究方向.     

面向运营商的P2P流媒体系统架构

针对现有流媒体系统存在的主要问题,本文提出了一种面向电信运营商的可运营、可管理、可扩展的P2P流媒体系统架构,并给出了该架构下流媒体点播业务的实现流程以及主要的资源调度和管理流程.该系统的建立可有效解决困扰业界已久的内容盗版、用户收费、质量保障等关键问题,协助P2P流媒体确立自身盈利模式.     

P2P技术现状及未来发展

P2P应用软件主要包括文件分发软件、语音服务软件、流媒体软件。目前P2P应用种类多、形式多样,没有统一的网络协议标准,其体系结构和组织形式也在不断发展。P2P应用已占运营商业务总量的60%～80%,P2P应用所产生的流量具有分布非均衡、上下行流量对称、流量隐蔽、数据集中等特性。在P2P技术的发展道路上,有许多尚待解决的问题。版权问题一直是P2P发展的一个不确定因素,如何在技术层面支持合法文件的分发是需要解决的重要问题。安全问题也是P2P领域的重要研究课题,如何在P2P网络中实现数据存取安全、路由安全、用户身份认证和身份管理都需要进一步研究。此外,如果能够实现P2P应用之间的统一资源定位,统一路由,使得P2P技术有一个统一开发标准,那么就能够融合P2P技术,提升P2P应用的整体性能。     

基于矩阵灰建模的单次P300检测新方法

针对少导联P300单次提取识别率较低的问题,提出了一种基于矩阵灰建模的参数模型法提取特征的方法,提高了P300单次识别率.首先对脑电信号进行预处理,然后选择导联组合,接着对每个Epoch进行建模,将模型参数作为特征向量输入SVM分类识别.结果表明,单次P300的平均识别率为91.43%,叠加平均3次正确率可高达97.87%.     

一种基于神经网络与证据理论融合的P2P业务感知模型

提出了一种基于神经网络与证据理论融合的P2P业务感知模型,该模型利用神经网络的非线性逼近能力和自学习能力,获取证据理论所需的基本概率值;并通过证据理论的数据融合明显提高业务感知准确率。实验结果表明,该模型与现行的P2P业务识别方法相比,能够快速、准确、可靠地识别P2P业务类别,实现合法有效的网络管理和控制,对检测网络异常行为与提高网络安全性具有重要意义。