基于最短划分距离的网络流量决策树分类方法

对不同类别的应用数据流,根据其在最初若干分组中进行握手和参数协商的差异性,通过通信模式、载荷长度以及信息熵等特征,采用基于最短划分距离的方法构建决策树模型,对其进行流量分类。经过在4个不同类型的真实网络数据集上的离线分类实验,以及在校园网环境中的在线流量分类实验。结果表明该模型对8种常见协议的网络流量,分析其前4到6个分组的特征,能够在分类准确性和系统开销上取得较好的效果。与其他机器学习算法相比,该模型构建的决策树规模较小,分类时间较短,适合于实时流量分类问题。

Network traffic classification using decision tree based on minimum partition distance

Before data communications,every application protocol need to handshake at application layer and transmit some parameters.This process is quite different according to the protocols,such as the packet direction,payload size and the information entropy of each packet payload.So according to these features,decision tree algorithm based on mini-mum partition distance was used to train the classifier.The results of the offline experiments on real network traces and the online classification experiments in campus network indicate that,analyzing the first four or six packets of each flow is enough to classify eight common used application protocols with high overall accuracy and low cost.Contrast to other machine learning algorithms,decision tree can achieve better accuracy on different traces and low classification time.So it is very suitable for real-time traffic classification.