基于流相关性的网络流量分类

网络流量分类技术对网络安全管理起着非常重要的作用。随着网络和信息技术的发展，传统的基于端口号和深度包检测分类方法的局限性愈发明显，不能对现有的流量进行准确分类。提出一种基于流相关性的半监督网络流量分类算法，并使用MDL-CON高斯混合模型作为聚类模型，通过聚类过程中利用流之间的相关性提高模型的准确度。采用MDL准则解决了高斯混合模型需要人为预先设定类簇数目和高度依赖于初始值的问题。实验结果表明，利用该方法来处理流量分类问题可取得理想的分类效果。

Network traffic classification based on correlation of flows

Network traffic classification is elementary to network security and management. With the development of network and information technology, the limitation of traditional port-based and payload-based classification approaches is that they can not classify network traffics accurately. This paper proposes a new semi-supervised approach based on correlation of flows, which is formulated by an MDL-CON Gaussian mixture model. In the process of cluster, the correlation between different flows is used to improve the quality of resultant traffic clusters, and the MDL rule is applied to solve preset clusters number and initialization issue. Experiments show that this approach can significantly improve the accuracy of traffic classification.