高速复杂网络异常流量安全监测和评估技术研究

网络技术在现实生活的应用越来越广泛,各种公共网络都已经被开放,随之而来的就是网络用户在急剧增多,在方便用户的同时,也产生了很多负面的影响。而网络异常流量就是其中一个很大的问题。文章对其定义和分类进行了简单的阐述,还详细介绍了评估方法,包括:网络异常流量的入侵评估方法;固定阈值方法;基于数据挖掘的方法;基于特征的评估方法;基于云计算的方法;基于统计分析的方法,希望对改进网络流量异常有所帮助。     

关于宽带流量监控及行为分析系统的部署及演进策略

对网络流量进行监控和行为分析对于改善网络环境有着十分重要的意义。本文就宽带网络的现状、系统构建部署的背景、网络流量的分类、以及流量监控所常用的技术进行了探讨。     

基于回归分析的网络流量测算方法

网络流量测算在网络规划、设备部署和异常流量预警等方面有广泛的应用.通过对现有网络进行样本数据采集,利用回归分析测算用户数量与网络流量的线性关系,求得相关参数,为网络运营管理提供精细化的数据支持.     

基于序列特征的网络流分类方法研究

如今,对网络流量中各种应用进行准确分类和识别已经变得越来越重要,针对目前流量分析研究的不足,本文综合国内外相关研究成果,提出了在双向动态网络流模型的基础上,采用细粒度的Packet-Level序列特征属性对流量进行分析,建立序列特征属性与网络流类型之间的关联关系,实现了一种高效的、与端口无关的网络流分类方法.     

基于机器学习的无线网络流量预测与增长潜力评估

提出一个基于机器学习的无线网络流量预测及流量增长潜力评估方案。该方案分析蜂窝网络中的实际业务流量数据在时间维度上的变化规律,并借助高斯过程的机器学习方法来预测业务变化趋势,从短期角度为运营商的网络优化部署提供指导。基于极限梯度提升(XGBoost)机器学习框架,建立网络中其他运营数据与业务流量的多维映射关系,应用改进的量子粒子群算法进一步寻找蜂窝小区所能承载的流量上限,从长期角度为网络优化部署提供指导,提升网络流量水平、释放流量增长潜力。     

园区网的综合网络流量监测系统设计

网络新业务及流量的增加给传统的网络流量监测造成困难,在分析传统网络流量监测方案的基础上,提出一种综合流量监测方案,能够较好地监测各种大中型园区网的流量,发现网络的异常,对系统中基于SNMP的流量监测以及基于网络流的流量监测分别进行较为详细的描述,最后给出部署该流量监测系统的优势。     

IP网络流量测量的研究与实现

网络流量测量是研究网络行为的基础．也是分析网络状况、掌握网络流量特性的有效方法。为了更好地管理网络资源．保障服务质量，对网络流量测量体系框架及测量系统的实现进行了研究．并基于TMA（Traffic Monitor and Analyzer）监测数据对IP网络的流量特性进行了分析．为网络规划及技术研究提供了参考。     

基于数学建模的无线通信网络异常流量检测方法

由于传统方法在无线通信网络异常流量检测应用中平均绝对百分比误差比较大,响应时间比较长,无法取得预期的异常流量检测效果,提出基于数学建模的无线通信网络异常流量检测方法。建立无线通信网络流量数学模型,描述网络流量状态,利用数学模型完成网络流量与参考流量对比,利用相像系数法提取到网络流量显性特征,利用小波分析技术提取到网络流量隐性特征,通过特征融合,并将特征值与阈值比较,识别检测到异常流量,以此完成基于数学建模的无线通信网络异常流量检测。经实验证明,设计方法平均绝对百分比误差小于1%,响应时间在2.5s以内,在无线通信网络异常流量检测方面具有良好的应用前景。     

基于多分类支持向量机的P2P流量识别模型的设计

文章研究了SVM(支持向量机)在P2P流量识别中的应用技术。首先介绍了一个基于SVM的P2P流量识别方法,对网络中的P2P流量进行识别,接着对经典1-vs-all多分类SVM算法进行了改进,提出了一个新的基于MC-SVM(多分类支持向量机)的分类判别方法,用来把之前所识别出的未知具体应用层分类的P2P流量进行应用层分类,最后通过真实的网络流量数据的实验,证明了其可行性。     

基于机器学习的物联网异常流量检测方法

随着物联网的广泛应用,物联网的安全问题受到越来越多的关注.针对物联网环境下异常网络流量问题,提出了基于机器学习的物联网异常流量检测方法.首先通过使用聚类算法分析物联网一段时间内网络数据的特征,然后使用连续假设检验算法对特征进行分类,并对恶意流量的空间分布进行二次特征分析.实验表明,相对于传统的异常流量检测方法,该检测方...     

基于卷积神经网络的Android流量分类方法

深度学习就是机器学习研究的过程,主要通过模拟人脑分析学习的过程对数据进行分析。目前,深度学习技术已经在计算机视觉、语音识别、自然语言处理等领域获得了较大发展,并且随着该技术的不断发展,为网络流量分类和异常检测带来了新的发展方向。移动智能手机与大家的生活息息相关,但是其存在的安全问题也日益凸显。针对传统机器学习算法对于流量分类需要人工提取特征、计算量大的问题,提出了基于卷积神经网络模型的应用程序流量分类算法。首先,将网络流量数据集进行数据预处理,去除无关数据字段,并使数据满足卷积神经网络的输入特性。其次,设计了一种新的卷积神经网络模型,从网络结构、超参数空间以及参数优化方面入手,构造了最优分类模型。该模型通过卷积层自主学习数据特征,解决了传统基于机器学习的流量分类算法中的特征选择问题。最后,通过CICAndmal2017网络公开数据集进行模型测试,相比于传统的机器学习流量分类模型,设计的卷积神经网络模型的查准率和查全率分别提高了2.93%和11.87%,同时在类精度、召回率以及F1分数方面都有较好的提升。     

End-to-end encrypted network traffic classification method based on deep learning

Network traffic classification, which matches network traffic for a specific class of different granularities, plays a vital role in the domain of network administration and cyber security. With the rapid development of network communication techniques, more and more network applications adopt encryption techniques during communication, which brings significant challenges to traditional network traffic classification methods. On the one hand, traditional methods mainly depend on matching features on the application layer of the ISO/OSI reference model, which leads to the failure of classifying encrypted traffic. On the other hand, machine learning-based methods require human-made features from network traffic data by human experts, which renders it difficult for them to deal with complex network protocols. In this paper, the convolution attention network (CAT) is proposed to overcom those difficulties. As an end-to-end model, CAT takes raw data as input and returns classification results automatically, with engineering by human experts. In CAT, firstly, the importance of different bytes with an attention mechanism of network traffic is achieved. Then, convolution neural network (CNN) is used to learn features automatically and feed the output into a softmax function to get classification results. It enables CAT to learn enough information from network traffic data and ensure the classified accuracy. Extensive experiments on the public encrypted network traffic dataset ISCX2016 demonstrate the effectiveness of the proposed model.     

Application layer classification of Internet traffic using ensemble learning models

Accurate application layer classification of Internet traffic has been a necessary requirement for various regulatory, control, and operational purposes of Internet service provider (ISP). Due to the dynamic and ever evolving nature of Internet applications generating a diverse mixture of Internet traffic, it has been necessary to apply deep packet inspection (DPI) techniques for traffic classification. DPI methods offer accuracy but degrade overall network throughput and thus cause problems in ensuring quality of service (QoS) and maintaining service-level agreements. Moreover, Internet traffic is mostly end to end encrypted. This in turn limits the applicability of DPI techniques and renders them useless, unless the encryption tunnel is broken by the service provider which would risk violating user privacy. To address these trade-offs between classification accuracy, performance, and user privacy, we resort to machine learning (ML)-based algorithms. In this article, we apply three ensemble ML algorithms and report their performance metrics in the application layer classification of Internet traffic.     

A federated semi-supervised learning approach for network traffic classification

The classification of network traffic, which involves classifying and identifying the type of network traffic, is the most fundamental step to network service improvement and modern network management. Classic machine learning and deep learning methods have widely adopted in the field of network traffic classification. However, there are two major challenges in practice. One is the user privacy concern in cross-domain traffic data sharing for the purpose of training a global classification model, and the other is the difficulty to obtain large amount of labeled data for training. In this paper, we propose a novel approach using federated semi-supervised learning for network traffic classification, in which the federated server and clients from different domains work together to train a global classification model. Among them, unlabeled data are used on the client side, and labeled data are used on the server side. The experimental results derived from a public dataset show that the accuracy of the proposed approach can reach 97.81%, and the accuracy gap between the federated learning approach and the centralized training method is minimal.     

Projection learning for self-organizing neural networks

A new learning scheme, called projection learning (PL), for self-organizing neural networks is presented. By iteratively subtracting out the projection of the “twinning” neuron onto the null space of the input vector, the neuron is made more similar to the input. By subtracting the projection onto the null space as opposed to making the weight vector directly aligned to the input, we attempt to reduce the bias of the weight vectors. This reduced bias will improve the generalizing abilities of the network. Such a feature is important in problems where the in-class variance is very high, such as, traffic sign recognition problems. Comparisons of PL with standard Kohonen learning indicate that projection learning is faster. Projection learning is implemented on a new self-organizing neural network model called the reconfigurable neural network (RNN). The RNN is designed to incorporate new patterns online without retraining the network. The RNN is used to recognize traffic signs for a mobile robot navigation system     

DDoS attack detection and defense based on hybrid deep learning model in SDN

Software defined network (SDN) is a new kind of network technology,and the security problems are the hot topics in SDN field,such as SDN control channel security,forged service deployment and external distributed denial of service (DDoS) attacks.Aiming at DDoS attack problem of security in SDN,a DDoS attack detection method called DCNN-DSAE based on deep learning hybrid model in SDN was proposed.In this method,when a deep learning model was constructed,the input feature included 21 different types of fields extracted from the data plane and 5 extra self-designed features of distinguishing flow types.The experimental results show that the method has high accuracy,it’s better than the traditional support vector machine (SVM) and deep neural network (DNN) and other machine learning methods.At the same time,the proposed method can also shorten the processing time of classification detection.The detection model is deployed in SDN controller,and the new security policy is sent to the OpenFlow switch to achieve the defense against specific DDoS attack.     

基于Moodle的在线学习平台的设计与实践

针对目前在线学习平台存在的问题,采用Moodle开源网络课程管理系统搭建在线学习平台的方法,建立了具有课程管理、在线测试、网上答疑、电子作业、教学反馈、电子学档等功能的在线学习平台。通过在该平台下进行的《Windows编程》的网络课程设计与实施的试验,表明在该在线学习平台下的自主与协作学习,可有效提高学生的实践能力和创新能力。     

Method of data cleaning for network traffic classification

Network traffic classification aims at identifying the application types of network packets. It is important for Internet service providers （ISPs） to manage bandwidth resources and ensure the quality of service for different network applications However, most classification techniques using machine learning only focus on high flow accuracy and ignore byte accuracy. The classifier would obtain low classification performance for elephant flows as the imbalance between elephant flows and mice flows on Internet. The elephant flows, however, consume much more bandwidth than mice flows. When the classifier is deployed for traffic policing, the network management system cannot penalize elephant flows and avoid network congestion effectively. This article explores the factors related to low byte accuracy, and secondly, it presents a new traffic classification method to improve byte accuracy at the aid of data cleaning. Experiments are carried out on three groups of real-world traffic datasets, and the method is compared with existing work on the performance of improving byte accuracy. Experiment shows that byte accuracy increased by about 22.31% on average. The method outperforms the existing one in most cases.     

Duty cycle learning algorithm (DCLA) for IEEE 802.15.4 beacon-enabled wireless sensor networks

The current specification of the IEEE 802.15.4 standard for beacon-enabled wireless sensor networks does not define how the fraction of the time that wireless nodes are active, known as the duty cycle, needs to be configured in order to achieve the optimal network performance in all traffic conditions. The work presented here proposes a duty cycle learning algorithm (DCLA) that adapts the duty cycle during run time without the need of human intervention in order to minimise power consumption while balancing probability of successful data delivery and delay constraints of the application. Running on coordinator devices, DCLA collects network statistics during each active duration to estimate the incoming traffic. Then, at each beacon interval uses the reinforcement learning (RL) framework as the method for learning the best duty cycle. Our approach eliminates the necessity for manually (re-)configuring the nodes duty cycle for the specific requirements of each network deployment. This presents the advantage of greatly reducing the time and cost of the wireless sensor network deployment, operation and management phases. DCLA has low memory and processing requirements making it suitable for typical wireless sensor platforms. Simulations show that DCLA achieves the best overall performance for either constant and event-based traffic when compared with existing IEEE 802.15.4 duty cycle adaptation schemes.