互联网五种典型应用的平均包长概率分布研究

作为流量识别的一个重要手段,深度流检测使用的统计特征中屡屡包含包长信息。从互联网五种典型应用的平均包长入手,利用滑动窗口模型探索五种应用在平均包长概率分布上的差异。对FTP、Foxmail、WWW、迅雷、Emule五种应用的实验表明:设置相同的滑动窗口,五种应用平均包长的均值有明显区别;设置不断增大的滑动窗口,五种应用平均包长的均值稳定,标准差逐渐减小。仅用包长信息可识别该五种应用。

Research on probability distribution of mean packet size for fiverepresentative applications in Internet

As a important method of traffic identification, DFI(deep flow inspection)employs statistical features which contains packet size information. This paper started with packet size belonging to five representative applications, utilized sliding window model to explore difference on probability distributution of mean packet size of different applications. The experiments on FTP, Foxmail, WWW, Thunder and Emule show:with the same size of sliding window, they behave different expectation of the mean packet size;with being greater size of sliding window, they behave stable expectation and gradually decreasing variance of the mean packet size. It is feasible to identify the five applications only based on packet size information.