CN102523241A - Method and device for classifying network traffic on line based on decision tree high-speed parallel processing - Google Patents
Method and device for classifying network traffic on line based on decision tree high-speed parallel processing Download PDFInfo
- Publication number
- CN102523241A CN102523241A CN2012100062687A CN201210006268A CN102523241A CN 102523241 A CN102523241 A CN 102523241A CN 2012100062687 A CN2012100062687 A CN 2012100062687A CN 201210006268 A CN201210006268 A CN 201210006268A CN 102523241 A CN102523241 A CN 102523241A
- Authority
- CN
- China
- Prior art keywords
- stream
- decision tree
- module
- classification
- packet
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Abstract
The invention relates to a method and a device for classifying network traffic on line based on decision tree high-speed parallel processing. The method comprises the following steps of: performing acquisition, distribution and manual classification on early real traffic data, extracting the packet characteristics of an early transmission control protocol (TCP) stream set, establishing a decision tree classification model, converting a data structure, performing distribution and class judgment on a data packet to be classified, tagging a current data packet, extracting the packet characteristics of a TCP stream to be classified, and searching for a decision tree. The device comprises a decision tree construction module, a structure conversion module, a classification result processing module, a medium access control (MAC) layer processing module, a data packet polling management module, a distribution judgment module, a traffic information extraction and tagging module, and a decision tree searching module. The method and the device are low in algorithm complexity and high in processing speed, classification accuracy and stability, and can be used for equipment and systems with requirements for online traffic classification in a high speed backbone network; and online classification can be realized.
Description
Technical field
The present invention relates to a kind of method and device of network traffics online classification, relate in particular to a kind of method and device, belong to communication technical field based on decision tree high-speed parallel processing policy realization TCP flow online classification.
Background technology
Nowadays, development of internet technology is more and more rapider, based on network applied more and more, becomes increasingly complex.Increasing Internet resources are not only being seized in various application, and QoS and network security have been brought huge threat.Under such background, a safe, reliable, efficient environment for use is provided how for vast Internet user, how to find and avoid the abnormal flow of network, be the major issue that field of network management need solve.In order to solve above-mentioned these problems, the network research personnel have proposed the efficiency of operation that a series of strategies such as flow scheduling, capacity planning improve network.Yet, no matter be that existing network is carried out extending capacity reformation, still carry out the QoS scheduling, all must carry out accurate classification and identification to the various application in the network traffics (like P2P, Web, IM, video flow etc.).In addition, in research fields such as network security, charge on traffic, application trend analyses, traffic classification accurately also is extremely important.The rapid popularization of cable broadband and 3G/4G makes this instrument that effectively carries out the network fine-grained management of traffic classification more have broad application prospects.
Traditional traffic classification technology is mainly based on the port information of transport layer; Yet in recent years; The Internet bandwidth improve constantly and the complicated and diversified gradually trend of application layer protocol under, the correlation of many network applications and port is more and more littler, situation such as camouflage port and dynamic port make said method be difficult to adaptive technique and application and development and demand; This just presses for introduces new theory and technology, the profound internal characteristics that excavates network application.The Internet data on flows is huge in order to adapt to, the characteristics of apply property dynamic change, and utilizing machine learning method to handle the traffic classification problem becomes emerging research focus in the current network field of measurement.For example: naive Bayesian algorithm, improvement bayesian algorithm, decision Tree algorithms, KNN algorithm, algorithm of support vector machine, neural network algorithm and various clustering algorithms or the like.Do not rely on transport layer port number or resolve pay(useful) load and come recognition network to use based on the traffic classification technology of machine learning; But the various statistical natures that utilize the stream that flow shows in transmission course are long as wrapping, the inter-packet gap time waits recognition network to use; Method itself is not pretended the influence of port, dynamic port, pay(useful) load encryption even network address translation; Aspect classification performance and flexibility, all have breakthrough than aforementioned the whole bag of tricks.
Yet at present industry also can't satisfy the demand of business development far away to the research of flow sorting technique, is mainly reflected in the means that present most of technology all adopts the off-line classification, can't realize the classification of real-time online.This has just limited the application of traffic classification technology in high-speed backbone.
In order to satisfy the needs of present and following high-speed backbone, some required below the traffic classification technology pressed for and satisfies: 1) classification accuracy is higher, avoids adopting port or payload as main recognition feature; 2) algorithm complex is lower, and the concrete characteristic that realizes will having in the design parallelization processing is easy to hardware and realizes (like FPGA, CPLD, ASIC etc.), guarantees the high speed online classification of network traffics; 3) classification stability better can be applicable to network environment complicated and changeable.
Summary of the invention
The invention provides a kind of method and device, can realize the high-speed real-time online classification of network traffics based on decision tree high-speed parallel processing policy realization TCP flow online classification, good stability, accuracy is high.
For realizing above-mentioned goal of the invention, the present invention adopts following technical scheme:
A kind of method based on decision tree high-speed parallel processing policy realization TCP flow online classification is characterized in that may further comprise the steps:
Step 1; Early stage real traffic data collection, shunting and manual sort: collection network real traffic data set; Utilize five-tuple that data set is separated into different TCP stream, manual sort is carried out in the set of TCP stream, make each bar TCP stream all corresponding with a kind of protocol type.
Step 2; Extract several bag characteristics that early stage, the TCP adfluxion was closed: extract in each bar TCP stream characteristic about packet; And make up preliminary characteristic sequence at the sequencing of this TCP stream according to packet; According to feature selecting algorithm the bag characteristic of preliminary extraction is handled then, filtered out the bag characteristic that best embodies the traffic category characteristic and form final characteristic sequence.
Step 3, the foundation of decision tree classification model: the final characteristic sequence to step 2 constitutes, utilize decision Tree algorithms to contribute.
Step 4; The decision tree of setting up in the step 3 is carried out the data structure conversion and stores in the memory device (like RAM, ROM, FLASH etc.) of hardware device (like FPGA, CPLD, ASIC etc.): through to the decision-making traversal of tree; Extract the intermediate node value of decision tree on the one hand, each intermediate node value of same attribute is carried out ordering from small to large, then each intermediate node value of all properties is carried out coding from small to large in order; Extract the fringe node value of decision tree on the other hand; The edge nodal value is equally also encoded, and the coding of fringe node value is a scope, depends on the encoded radio that arrives each intermediate node that this fringe node experienced.Intermediate node value and coding thereof and fringe node value and coding thereof are stored in respectively in the memory device (like RAM, ROM, FLASH etc.) of two separation.Wherein before the traffic classification device is used for the network traffics online classification, sets up decision tree and decision tree is carried out the data structure conversion with the mode of processed offline.
Step 5, the packet of treating classification are shunted and classification is judged: packet is divided into not homogeneous turbulence and searches stream information table and obtain classified information according to five-tuple, stream information table is used for the five-tuple information of recorded stream and the classification of this stream.Stream information table only need be preserved the record of classified stream, need not preserve the record of non-classified stream, so the flow information table if it is unfiled not exist record then can be judged as immediately, is searched the time thereby save when searching.
Step 6; Current data packet labelled to handle and extract wait to classify the bag characteristic of TCP stream: utilize classification information that step 5 extracts the processing that labels of the packet of all processes; If the stream under the packet is classified, then stamp corresponding class label, if unfiled; Then, judge then whether this packet need be extracted the bag characteristic and do handled according to the label of certain acquiescence of principle mark.Here; The bag Feature Extraction is corresponding with the final characteristic sequence of employing in the step 2; Need extract in proper order by bag arrival; And make up the characteristic sequence of the stream of waiting to classify, and the order information of bag is arranged according to the time sequencing that arrives observation station, and first request package of getting three-way handshake is Setup bag first bag as this stream.The characteristic sequence of stream of waiting to classify is stored in the parameter list, and a record of parameter list comprises the sign that five-tuple, each bag characteristic value and parameter be whether full.Classified the bag of being stamped correct label and the unfiled bag of stamping default label and need carrying out parameter extraction need carry out clock synchronization and handle, and the streamline that promptly inserts appropriate level spillover can not occur to guarantee the FIFO on the data packet transmission route.
Step 7, decision tree is searched: utilize the classify characteristic sequence of stream waited of step 6 gained that two memory devices (like RAM, ROM, FLASH etc.) of step 4 gained are searched, judge the classification value of this TCP stream and upgrade stream information table.In search procedure, adopt the parallel processing strategy, only need two clock cycle can accomplish the search procedure of decision tree.Be parallel relatively all intermediate node values of all properties of first clock cycle; Confirm all intermediate node encoded radios that this stream is affiliated and merge into data; Second clock cycle utilized the parallel relatively encoded radio of all fringe nodes of the result data of previous clock cycle, thereby confirms the classification of this stream.
A kind of flow online classification device based on hardware device (like FPGA, CPLD, ASIC etc.); Be used to realize that the above-mentioned device that utilizes decision tree high-speed parallel processing policy realization TCP flow online classification comprises online part and off-line part, wherein off-line partly has decision tree achievement module, decision tree structure modular converter, classification results processing module; Online part comprises that the MAC layer processing module one that be linked in sequence, packet poll administration module, shunting judge module, flow information extraction and the module that labels, decision tree search module, MAC layer processing module two.Wherein, the decision tree structure modular converter of off-line part is searched module with the decision tree of online part and is connected, and the classification results processing module of off-line part is searched module with the decision tree of online part and is connected indirectly through a stream information table.Online part adopts the pipeline processes technology.
Decision tree achievement module, be used for according to early stage the live network data traffic set up decision-tree model.
The decision tree structure modular converter; Be used for the structure of decision-tree model is changed; Make it to become in the memory device (like RAM, ROM, FLASH etc.) that is easy to hard-wired another kind of data structure and stores hardware device (like FPGA, CPLD, ASIC etc.) into: through to the decision-making traversal of tree; Extract the intermediate node value of decision tree on the one hand, each intermediate node value of same attribute is carried out ordering from small to large, then each intermediate node value of all properties is carried out coding from small to large in order; Extract the fringe node value of decision tree on the other hand; The edge nodal value is equally also encoded, and the coding of fringe node value is a scope, depends on the encoded radio that arrives each intermediate node that this fringe node experienced.Intermediate node value and coding thereof and fringe node value and coding thereof are stored in respectively in the memory device (like RAM, ROM, FLASH etc.) of two separation.
Nowadays MAC layer processing module have many ready-made IP kernels to adopt.
Packet poll administration module is used for from N packet buffer queue read data packet, adopts each input rank of poll formula visit here, just forwards next formation to up to running through a complete packet from a formation.
The shunting judge module is used for according to five-tuple packet being divided into not homogeneous turbulence, judges whether this stream is classified, if classified, how many classification values is, and safeguards stream information table.Stream information table is used for the five-tuple information of recorded stream and the classification of this stream.Stream information table is only searched module by decision tree and is carried out update processing, and other modules all can not be carried out write operation by the flow information table.
The flow information extraction and the module that labels are used for non-classified packet is flowed feature extraction and to the processing that labels of all packets.This module need be safeguarded a parameter list, the sign whether five-tuple information, characteristic value and the characteristic value of each bar stream of parameter list record be full.The parameter information of the stream that characteristic value is full is sent to decision tree and searches module.
Decision tree is searched module; Be used to utilize flow information extraction and the module that labels is sent that wait the to classify characteristic sequence of stream is searched two memory devices (like RAM, ROM, FLASH etc.) of decision tree structure modular converter gained, judge the classification value of this TCP stream and upgrade stream information table.In search procedure, adopt the parallel processing strategy, only need two clock cycle can accomplish the search procedure of decision tree.Be parallel all intermediate node values of searching all properties of first clock cycle; Confirm all intermediate node encoded radios that this stream is affiliated and merge into data; Second clock cycle utilized the result data of previous clock cycle to walk abreast and searches the encoded radio of all fringe nodes; Thereby confirm the classification of this stream, and classification results is sent to stream information table upgrades with the record in the flow information table.
The classification results processing module, be used for to the flow sorting result gather, processing and interface display.
Therefore, traffic classification method and apparatus provided by the invention has the following advantages: the structure to decision tree is changed, and makes it to convert to a kind of hard-wired data structure that is easy to, and has reduced the complexity of algorithm itself; Use parallel searching and pipelining in the decision tree search procedure, improved processing speed; The bag characteristic extraction procedure of choosing is simple, is easy to online completion; The accuracy of having utilized decision tree itself to be had is high, the characteristics of good stability.In a word, lower algorithm complex, efficient hardware canbe used on line mode, accurate stable flow rate classification results have constituted greatest feature of the present invention.
Description of drawings
In order to be illustrated more clearly in the present invention; The accompanying drawing of required use is done simple the introduction in will describing the embodiment of the invention below; Apparently, the accompanying drawing in describing below only is the structural representation of traffic classification method flow diagram of the present invention, traffic classification device, for those of ordinary skills; Do not paying under the creative work prerequisite, can also be according to the more accompanying drawing of these accompanying drawings acquisitions.
Fig. 1 is the traffic classification method flow diagram that one embodiment of the invention provides;
Fig. 2 is the structural representation of the traffic classification device that provides of one embodiment of the invention;
Embodiment
The accompanying drawing that will combine the embodiment of the invention below carries out clear, intactly description to technical scheme in the embodiment of the invention and device.This embodiment is that example is described in detail with C4.5 algorithm in the decision tree, but the method is applicable to other decision Tree algorithms equally.This embodiment realizes that based on FPGA the memory device of employing is RAM, is equally applicable to other hardware devices (like FPGA, CPLD, ASIC etc.) and memory device (like RAM, ROM, FLASH etc.).Obviously, described embodiment only is the present invention's part embodiment, rather than whole embodiment.Based on the embodiment among the present invention, those of ordinary skills belong to protection scope of the present invention not making the every other embodiment that is obtained under the creative work prerequisite.
The flow chart of the traffic classification method that Fig. 1 provides for one embodiment of the invention, this method comprises:
S101: collect a plurality of network traffics data sets from different places at different time, and data set is shunted and manual sort.
The net flow assorted device generally is deployed in certain network.Decision Tree algorithms need utilize the real traffic in the network to train, and to make up the decision tree classification model, therefore need in the network of preparing for deployment, network probe be set, so that from network, gather real traffic.Above-mentioned real traffic data set comprises and is used for the information that manual sort confirms that the flow protocol type is required, and the required characteristic parameters of subsequent step such as long data packet, inter-packet gap time, bag direction; See from transport layer protocol, comprise TCP stream and UDP stream in the data flow at least.Need according to { source address, destination address, source port, destination interface, transport layer protocol type } five-tuple gained data on flows collection be separated into different TCP stream to the data on flows collection, the data on flows collection has just become the set of TCP stream like this; Wherein, the basis for estimation of the head of TCP stream can be used but be not limited to Setup, Setup/ACK, the ack msg bag in the TCP stream; And packet must be arranged according to the sequencing that reaches observation station in the data flow.Adopt methods such as loading analysis, obtain the protocol type that tcp data flows with offline mode, like WWW, MAIL, FTP, P2P etc.
S102: extract several bag characteristics that early stage, the TCP adfluxion was closed.
Extract in each bar TCP stream about the characteristic of packet, the bag that promptly extracts 10 bags of every stream head is long, inter-packet gap time and bag direction of transfer.In this step, the bag characteristic of every stream of extraction has three major types, and one type is the long attribute of bag, one type be the inter-packet gap attribute, another kind of be to wrap direction.Just the bag of first bag bag long, second bag bag long, the 3rd bag is long ... The bag of the tenth bag is long; The blanking time of blanking time (being 0), second bag and the blanking time of first bag, the 3rd bag and second bag of first bag and zero bag .... the blanking time of the tenth bag and the 9th bag; The direction of the direction of the direction of first bag, second bag, the 3rd bag ... The direction of the tenth bag.And make up preliminary characteristic sequence at the sequencing of this TCP stream according to packet, and utilize feature selecting algorithm that the bag characteristic is screened then, obtain final characteristic sequence.
S103: set up the decision tree classification model.
Utilize high-level programming language such as Java, Matlab etc. or directly utilize machine learning Weka software,, set up decision-tree model based on the C4.5 algorithm of classics according to live network data traffic in early stage.
S104: decision tree is carried out Structure Conversion and stores among the RAM of FPGA.
Through to the decision-making traversal of tree, extract on the one hand the intermediate node value of decision tree, promptly from top to bottom traversal and the extraction of intermediate node value are carried out in all paths.Have the intermediate node based on different attribute on one paths, the intermediate node of same kind of attribute also possibly be present on the different paths.All intermediate node values of one tree are extracted the back summarized results, then each intermediate node value of same attribute is carried out ordering from small to large, then each intermediate node value of all properties is carried out coding from small to large in order.For example; If the intermediate node value of the long attribute of bag is respectively 70,80,90,100,110 from small to large, the coding figure place is 3, and then intermediate node value 70 is encoded to 000; Intermediate node value 80 is encoded to 001; Intermediate node value 90 is encoded to 010, and intermediate node value 100 is encoded to 011, and intermediate node value 110 is encoded to 100; The coding of inter-packet gap attribute and bag direction attribute intermediate node value similarly.Extract the fringe node value of decision tree on the other hand, the edge nodal value is equally also encoded, the coding of fringe node value is a scope, depends on the encoded radio of each intermediate node that the path experienced that arrives this fringe node.Intermediate node value and coding thereof and fringe node value and coding thereof are stored in respectively among the RAM of two separation.Wherein before the traffic classification device is used for the network traffics online classification, sets up decision tree and decision tree is carried out the data structure conversion with the mode of processed offline.
The storage organization of two block RAMs is shown in table 1, table 2.Record of a behavior in the table, the encoded radio of each record intermediate node value of storage and this intermediate node value.Wherein, n1 representes the intermediate node sum of the 1st attribute, and n2 representes the intermediate node sum of the 2nd attribute, and nk representes the intermediate node sum of k attribute, the sum of m presentation protocol type.
Table 1 intermediate node value and encoded radio thereof the storage mode in RAM
| The intermediate node value | The intermediate node encoded radio |
| The 1st intermediate node value of the 1st attribute | The 1st intermediate node encoded radio of the 1st attribute |
| The 2nd intermediate node value of the 1st attribute | The 2nd intermediate node encoded radio of the 1st attribute |
| … | ?… |
| N1 intermediate node value of the 1st attribute | N1 intermediate node encoded radio of the 1st attribute |
| The 1st intermediate node value of the 2nd attribute | The 1st intermediate node encoded radio of the 2nd attribute |
| The 2nd intermediate node value of the 2nd attribute | The 2nd intermediate node encoded radio of the 2nd attribute |
| … | … |
| N2 intermediate node value of the 2nd attribute | N2 intermediate node encoded radio of the 2nd attribute |
| …………………… | ……………………….. |
| The 1st intermediate node value of k attribute | The 1st intermediate node encoded radio of k attribute |
| The 2nd intermediate node value of k attribute | The 2nd intermediate node encoded radio of k attribute |
| … | … |
| Nk intermediate node value of k attribute | Nk intermediate node encoded radio of k attribute |
Table 2 nodal value and encoded radio thereof the storage mode in RAM
| Nodal value (being the classification value) | The nodes encoding value |
| The 1st kind of protocol class offset | The 1st kind of protocol type encoded radio scope |
| The 2nd kind of protocol class offset | The 2nd kind of protocol type encoded radio scope |
| …………………… | ……………………. |
| M kind protocol class offset | M kind protocol type encoded radio scope |
S105: the packet of treating classification is shunted
According to { source address, destination address, source port, destination interface, transport layer protocol type } five-tuple packet is divided into not homogeneous turbulence and safeguards stream information table, stream information table is used for the five-tuple information of recorded stream and the classification of this stream.At this, only the TCP stream of complete semantic is analyzed.Shaking hands with 3 times of TCP is the beginning of stream, with the FIN=1 of TCP or the RST=1 end as stream.Five-tuple information { source address, destination address, source port, destination interface, transport layer protocol type } according to message in the network judges whether to be a stream.If five-tuple is identical, then belong to same stream.Otherwise, be homogeneous turbulence not.Wherein, if the source address of two bags is identical, then belong to network flow in the same way; If source address is identical with destination address, then belong to reverse network flow; And agreement, with first message forwarding direction up direction that is this network flow.In addition, if two messages surpass certain hour at interval, then belong to various network stream.Each bar record comprises following content in the stream information table: the ID of a stream of sign, { source address, destination address, source port, destination interface, transport layer protocol type } five-tuple, the protocol type that identifies.Stream information table only need be preserved the record of classified stream, need not preserve the record of non-classified stream, so the flow information table if it is unfiled not exist record then can be judged as immediately, is searched the time thereby save when searching.
S106: judge whether the TCP stream under this packet classifies
Utilize the five-tuple information of the packet of S105 extraction, the flow information table is searched, and sees the pairing record of stream that whether has had this five-tuple representative in the table; If there is record; Then read the classification value of this stream, if there is not record, then this stream is not classified.
S107: classified packet is stamped correct label
Utilize classification information that step S106 obtains to the processing that labels of the packet of all processes, if the stream under the packet is classified, then stamp corresponding class label, classification finishes.
S108: non-classified packet is stamped default label and extracted the bag characteristic of the TCP stream of waiting to classify
For non-classified packet,, judge then whether this packet need be extracted the bag characteristic and do handled according to the label of certain acquiescence of principle mark.Here; The final characteristic sequence that adopts among bag Feature Extraction and the S102 is corresponding; Certain attribute or some attribute that promptly extracts certain bag or some bag be with S102 in final characteristic sequence corresponding to, need extract in proper order by bag arrival, and make up the characteristic sequence of the stream of waiting to classify.Similar with stream information table; The flow information extraction module also will be safeguarded a parameter list, and each bar record comprises following content in the parameter list: ID, source address, destination address, source port, destination interface, the transport layer protocol type of a stream of sign } blanking time of five-tuple, certain bag and previous bag, the bag of certain bag long, certain bag bag direction, this stream parameter full scale will whether.
Network data (being the frame in the transmission of data packets) transmission is impregnable, and reason is the flow information extraction module as a data probe, and the parameter information that only will pass by this module copies out, and does not change the transmission time sequence of any data and data.
S109, decision tree is searched.
Utilize the classify characteristic sequence of stream waited of S108 gained that two block RAMs of S104 gained are searched, judge the classification value of this TCP stream and upgrade stream information table.In search procedure, adopt the parallel processing strategy, only need two clock cycle can accomplish the search procedure of decision tree.Be parallel relatively all intermediate node values of all properties of first clock cycle, confirm all intermediate node encoded radios that this stream is affiliated.That is to say; It is interval to confirm the intermediate node value scope under the 1st attribute that first clock cycle need be accomplished the comparison of n1 intermediate node value of the 1st attribute; The comparison of n2 intermediate node value of accomplishing the 2nd attribute is interval to confirm the intermediate node value scope under the 2nd attribute ... The comparison of nk intermediate node value of accomplishing k attribute is confirming the fringe node value scope interval under k the attribute, and this n1+n2+ ... + nk comparator walks abreast simultaneously and begins to carry out.After first clock cycle finishes; Can confirm the intermediate node scope of all properties that this stream is affiliated; Can confirm simultaneously all intermediate node encoded radios that this stream is affiliated through the record among the RAM, the corresponding intermediate node encoded radio of one of them attribute, then corresponding k intermediate node encoded radio of a stream; This k intermediate node encoded radio merged into data; Amalgamation result data parallel all fringe node encoded radios relatively that second clock cycle utilized the previous clock cycle, thus confirm the fringe node value of this stream, protocol class value just.
Fig. 2 is the structural representation of traffic classification device provided by the present invention.
See that from function this traffic classification device can be divided into online and two parts of off-line.Main structure and the data structure conversion of accomplishing decision tree of off-line part; Online part mainly is responsible for the classification of unknown traffic.Off-line partly comprises the data traffic acquisition module 201 in early stage that is linked in sequence, early stage data flow diverter module 202, early stage data flow manual sort module 203, early stage data flow characteristic extracting module 204, decision tree achievement module 205, decision tree structure modular converter 206 and the classification results processing module 207 in later stage; Online part comprises that the MAC layer processing module 1 that be linked in sequence, packet poll administration module 212, shunting judge module 213, flow information extraction and the module 214 that labels, decision tree search module 215, MAC layer processing module 2 216.
In this traffic classification device; Data flow characteristic extracting module 204, decision tree achievement module 205, decision tree structure modular converter 206 can be accomplished before device is disposed, so not be to use the device of traffic classification or the necessary component of system early stage data traffic acquisition module 201, early stage data flow diverter module 202, early stage data flow manual sort module 203, early stage.And MAC layer processing module 1, packet poll administration module 212, shunting judge module 213, flow information extraction and the module 214 that labels, decision tree are searched module 215, MAC layer processing module 2 216, classification results processing module 207 and generally should in the device of use traffic classification or system, occur.
Each module concrete function and handling process are following: before the device that has traffic classification or system's use; Need to use data traffic acquisition module 201 in early stage, early stage data flow diverter module 202, early stage data flow manual sort module 203,, early stage data flow characteristic extracting module 204, decision tree achievement module 205, decision tree structure modular converter 206 accomplish the work of S101～S104 among Fig. 1, the decision tree data structure through conversion of formation places the RAM of device.After the packet of a unknown classification gets into the traffic classification device; And MAC layer processing module 1,212 pairs of packets of packet poll administration module are carried out preliminary treatment; Shunting judge module 213 is divided into packet not homogeneous turbulence and safeguards stream information table according to { source address, destination address, source port, destination interface, transport layer protocol type } five-tuples; The flow information table is searched with the classification under the specified data bag then, accomplishes the work of S105～S106 among Fig. 1.The flow information extraction and the module 214 that labels according to the classification information obtained of shunting judge module 213 to the packet processing that labels; Press the packet sequencing simultaneously; Extract parameters such as bag is long, correction inter-packet gap time, direction of transfer successively; Form characteristic sequence, send into the work that decision tree is searched module 215, accomplishes S107～S109 among Fig. 1.Stream information table is only searched module 215 by decision tree and is carried out update processing, and other modules all can not be carried out write operation by the flow information table.207 pairs of packets of MAC layer processing module 2 216 and classification results processing module carry out follow-up processing and show classification results.
The method and apparatus that present embodiment provides has carried out the data structure conversion to the decision tree of adopting the C4.5 algorithm to set up, and makes it to convert to a kind of hard-wired data structure that is easy to, and has reduced the complexity of algorithm itself; Use parallel searching and pipelining in the decision tree search procedure, improved processing speed; The bag characteristic extraction procedure of choosing is simple, is easy to online completion; The accuracy of having utilized C4.5 algorithm itself to be had is high, the characteristics of good stability.Therefore, present embodiment can be realized the high speed online classification of network traffics easily.
What should explain at last is: above embodiment is only in order to explaining technical scheme of the present invention and device, but not to its restriction; Although with reference to previous embodiment the present invention has been carried out detailed explanation, those of ordinary skill in the art is to be understood that; It still can be made amendment to the technical scheme that aforementioned each embodiment put down in writing, and perhaps technical characterictic wherein is equal to replacement; And these are revised or replacement, do not make the spirit and the scope of the essence disengaging various embodiments of the present invention technical scheme of relevant art scheme.
Claims (10)
1. realize it is characterized in that the method for TCP flow online classification may further comprise the steps based on decision tree high-speed parallel processing policy for one kind:
Step 1; Early stage real traffic data collection, shunting and manual sort: collection network real traffic data set; Utilize five-tuple that data set is separated into different TCP stream, manual sort is carried out in the set of TCP stream, make each bar TCP stream all corresponding with a kind of protocol type.
Step 2; Extract several bag characteristics that early stage, the TCP adfluxion was closed: extract in each bar TCP stream characteristic about packet; And make up preliminary characteristic sequence at the sequencing of this TCP stream according to packet, and then the bag characteristic is screened, obtain final characteristic sequence.
Step 3, the foundation of decision tree classification model: the final characteristic sequence to step 2 constitutes, utilize decision Tree algorithms to contribute.
Step 4; The decision tree of setting up in the step 3 is carried out the data structure conversion and stores in the memory device (like RAM, ROM, FLASH etc.) of hardware device (like FPGA, CPLD, ASIC etc.): through to the decision-making traversal of tree; Extract the intermediate node value of decision tree on the one hand, each intermediate node value of same attribute is carried out ordering from small to large, then each intermediate node value of all properties is carried out coding from small to large in order; Extract the fringe node value of decision tree on the other hand; The edge nodal value is equally also encoded, and the coding of fringe node value is a scope, depends on the encoded radio that arrives each intermediate node that this fringe node experienced.Intermediate node value and coding thereof and fringe node value and coding thereof are stored in respectively in the memory device (like RAM, ROM, FLASH etc.) of two separation.
Step 5, the packet of treating classification are shunted and classification is judged: packet is divided into not homogeneous turbulence and searches stream information table and obtain classified information according to five-tuple, stream information table is used for the five-tuple information of recorded stream and the classification of this stream.
Step 6; Current data packet labelled to handle and extract wait to classify the bag characteristic of TCP stream: utilize classification information that step 5 extracts the processing that labels of the packet of all processes; If the stream under the packet is classified, then stamp corresponding class label, if unfiled; Then, judge then whether this packet need be extracted the bag characteristic and do handled according to the label of certain acquiescence of principle mark.Here; The bag Feature Extraction is corresponding with the final characteristic sequence of employing in the step 2; Need extract in proper order by bag arrival; And make up the characteristic sequence of the stream of waiting to classify, and the characteristic sequence of the stream of waiting to classify is stored in the parameter list, and a record of parameter list comprises the sign that five-tuple, each bag characteristic value and parameter be whether full.
Step 7, decision tree is searched: utilize the classify characteristic sequence of stream waited of step 6 gained that two memory devices (like RAM, ROM, FLASH etc.) of step 4 gained are searched, judge the classification value of this TCP stream and upgrade stream information table.
2. TCP flow online classification method according to claim 1 is characterized in that:
Wherein before the traffic classification device is used for the network traffics online classification, sets up decision tree and decision tree is carried out the data structure conversion with the mode of processed offline.
3. TCP flow online classification method according to claim 1 is characterized in that:
In the said step 2, need several bag characteristics of preliminary extraction to be handled, filter out the bag characteristic that best embodies the traffic category characteristic according to feature selecting algorithm.
4. TCP flow online classification method according to claim 1 is characterized in that:
In the said step 5, stream information table only need be preserved the record of classified stream, need not preserve the record of non-classified stream, so the flow information table if it is unfiled not exist record then can be judged as immediately, is searched the time thereby save when searching.
5. TCP flow online classification method according to claim 1 is characterized in that:
In the said step 6, the order information of bag is arranged according to the time sequencing that arrives observation station, and first request package of getting three-way handshake is Setup bag first bag as this stream.
6. TCP flow online classification method according to claim 1 is characterized in that:
In the said step 6; Classified the bag of being stamped correct label and the unfiled bag of stamping default label and need carrying out parameter extraction need carry out clock synchronization and handle, and the streamline that promptly inserts appropriate level spillover can not occur to guarantee the FIFO on the data packet transmission route.
7. TCP flow online classification method according to claim 1 is characterized in that:
In the said step 7, the structure that adopts parallel mode of searching and streamline under the situation of not considering other read-writes and clock Synchronous Processing, only needs two clock cycle can accomplish the search procedure of decision tree to improve seek rate.Be parallel relatively all intermediate node values of all properties of first clock cycle; Confirm all intermediate node encoded radios that this stream is affiliated and merge into data; Second clock cycle utilized the parallel relatively encoded radio of all fringe nodes of the result data of previous clock cycle, thereby confirms the classification of this stream.
8. flow online classification device based on hardware device (like FPGA, CPLD, ASIC etc.); Be used to realize that the device that utilizes decision tree high-speed parallel processing policy to realize TCP flow online classification as claimed in claim 1 comprises online part and off-line part, wherein off-line partly has decision tree achievement module, decision tree structure modular converter, classification results processing module; Online part comprises that the MAC layer processing module one that be linked in sequence, packet poll administration module, shunting judge module, flow information extraction and the module that labels, decision tree search module, MAC layer processing module two.Online part adopts the pipeline processes technology.
Decision tree achievement module, be used for according to early stage the live network data traffic set up decision-tree model.
The decision tree structure modular converter; Be used for the structure of decision-tree model is changed; Make it to become in the memory device (like RAM, ROM, FLASH etc.) that is easy to hard-wired another kind of data structure and stores hardware device (like FPGA, CPLD, ASIC etc.) into: through to the decision-making traversal of tree; Extract the intermediate node value of decision tree on the one hand, each intermediate node value of same attribute is carried out ordering from small to large, then each intermediate node value of all properties is carried out coding from small to large in order; Extract the fringe node value of decision tree on the other hand; The edge nodal value is equally also encoded, and the coding of fringe node value is a scope, depends on the encoded radio that arrives each intermediate node that this fringe node experienced.Intermediate node value and coding thereof and fringe node value and coding thereof are stored in respectively in the memory device (like RAM, ROM, FLASH etc.) of two separation.
Nowadays MAC layer processing module have many ready-made IP kernels to adopt.
Packet poll administration module is used for from N packet buffer queue read data packet, adopts each input rank of poll formula visit here, just forwards next formation to up to running through a complete packet from a formation.
The shunting judge module is used for according to five-tuple packet being divided into not homogeneous turbulence, judges whether this stream is classified, if what are by the class categories value, and safeguards that stream information table, stream information table are used for the five-tuple information of recorded stream and the classification of this stream.
The flow information extraction and the module that labels are used for non-classified packet is flowed feature extraction and to the processing that labels of all packets.This module need be safeguarded a parameter list, the sign whether five-tuple information, characteristic value and the characteristic value of each bar stream of parameter list record be full.The parameter information of the stream that characteristic value is full is sent to decision tree and searches module.
Decision tree is searched module; Be used to utilize flow information extraction and the module that labels is sent that wait the to classify characteristic sequence of stream is searched two memory devices (like RAM, ROM, FLASH etc.) of decision tree structure modular converter gained, judge the classification value of this TCP stream and upgrade stream information table.In search procedure, adopt the parallel processing strategy, only need two clock cycle can accomplish the search procedure of decision tree.Be parallel relatively all intermediate node values of all properties of first clock cycle; Confirm all intermediate node encoded radios that this stream is affiliated and merge into data; Second clock cycle utilized the parallel relatively encoded radio of all fringe nodes of the result data of previous clock cycle; Thereby confirm the classification of this stream, and classification results is sent to stream information table upgrades with the record in the flow information table.
The classification results processing module, be used for to the flow sorting result gather, processing and interface display.
9. TCP flow online classification device according to claim 8 is characterized in that:
The decision tree structure modular converter of off-line part is searched module with the decision tree of online part and is connected, and the classification results processing module of off-line part is searched module with the decision tree of online part and is connected indirectly through a stream information table.
10. TCP flow online classification device according to claim 8 is characterized in that:
Said off-line part also has data traffic acquisition module in early stage, early stage data flow diverter module, early stage data flow manual sort module, early stage data flow characteristic extracting module.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210006268.7A CN102523241B (en) | 2012-01-09 | 2012-01-09 | Method and device for classifying network traffic on line based on decision tree high-speed parallel processing |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210006268.7A CN102523241B (en) | 2012-01-09 | 2012-01-09 | Method and device for classifying network traffic on line based on decision tree high-speed parallel processing |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN102523241A true CN102523241A (en) | 2012-06-27 |
| CN102523241B CN102523241B (en) | 2014-11-19 |
Family
ID=46294033
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201210006268.7A Active CN102523241B (en) | 2012-01-09 | 2012-01-09 | Method and device for classifying network traffic on line based on decision tree high-speed parallel processing |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN102523241B (en) |
Cited By (24)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102904890A (en) * | 2012-10-12 | 2013-01-30 | 哈尔滨工业大学深圳研究生院 | State detection method for cloud data packet header |
| CN103209169A (en) * | 2013-02-23 | 2013-07-17 | 北京工业大学 | Network flow filtering system and method based on field programmable gate array (FPGA) |
| CN104125106A (en) * | 2013-04-23 | 2014-10-29 | 中国银联股份有限公司 | Network purity detection device and method based on classified decision tree |
| CN105162663A (en) * | 2015-09-25 | 2015-12-16 | 中国人民解放军信息工程大学 | Online traffic identification method based on flow set |
| CN105637904A (en) * | 2013-12-13 | 2016-06-01 | 瑞典爱立信有限公司 | Traffic coordination for communication sessions involving wireless terminals and server devices |
| CN106408007A (en) * | 2016-09-07 | 2017-02-15 | 国家电网公司 | Power communication network flow classification method and system |
| CN106572486A (en) * | 2016-10-17 | 2017-04-19 | 湖北大学 | Handheld terminal traffic identification method and system based on machine learning |
| CN106975617A (en) * | 2017-04-12 | 2017-07-25 | 北京理工大学 | A kind of Classification of materials method based on color selector |
| CN107251537A (en) * | 2015-02-10 | 2017-10-13 | 瑞典爱立信有限公司 | Method and apparatus for data agent |
| CN107391912A (en) * | 2017-07-04 | 2017-11-24 | 大连大学 | The hospital clinical operation data system of selection for the size stream classification applied in cloud data center system |
| CN108229573A (en) * | 2018-01-17 | 2018-06-29 | 北京中星微人工智能芯片技术有限公司 | Classified calculating method and apparatus based on decision tree |
| CN108304164A (en) * | 2017-09-12 | 2018-07-20 | 马上消费金融股份有限公司 | A kind of development approach and development system of service logic |
| CN109063777A (en) * | 2018-08-07 | 2018-12-21 | 北京邮电大学 | Net flow assorted method, apparatus and realization device |
| CN109086815A (en) * | 2018-07-24 | 2018-12-25 | 中国人民解放军国防科技大学 | Floating point number discretization method in decision tree model based on FPGA |
| CN109246095A (en) * | 2018-08-29 | 2019-01-18 | 四川大学 | A kind of communication data coding method suitable for deep learning |
| CN109784370A (en) * | 2018-12-14 | 2019-05-21 | 中国平安财产保险股份有限公司 | Data map generation method, device and computer equipment based on decision tree |
| CN110445689A (en) * | 2019-08-15 | 2019-11-12 | 平安科技（深圳）有限公司 | Identify the method, apparatus and computer equipment of internet of things equipment type |
| CN112887300A (en) * | 2021-01-22 | 2021-06-01 | 北京交通大学 | Data packet classification method |
| CN113240036A (en) * | 2021-05-28 | 2021-08-10 | 北京达佳互联信息技术有限公司 | Object classification method and device, electronic equipment and storage medium |
| CN113360740A (en) * | 2021-06-04 | 2021-09-07 | 上海天旦网络科技发展有限公司 | Data packet labeling method and system |
| CN113810311A (en) * | 2021-09-14 | 2021-12-17 | 北京左江科技股份有限公司 | Data packet classification method based on multiple decision trees |
| CN114900474A (en) * | 2022-05-05 | 2022-08-12 | 鹏城实验室 | Data packet classification method, system and related equipment for programmable switch |
| CN116226893A (en) * | 2023-05-09 | 2023-06-06 | 北京明苑风华文化传媒有限公司 | Client marketing information management system based on Internet of things |
| CN116521963A (en) * | 2023-07-04 | 2023-08-01 | 北京智麟科技有限公司 | Method and system for processing calculation engine data based on componentization |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US9882807B2 (en) | 2015-11-11 | 2018-01-30 | International Business Machines Corporation | Network traffic classification |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US5870735A (en) * | 1996-05-01 | 1999-02-09 | International Business Machines Corporation | Method and system for generating a decision-tree classifier in parallel in a multi-processor system |
| US20040230745A1 (en) * | 2003-05-12 | 2004-11-18 | International Business Machines Corporation | Parallel cache interleave accesses with address-sliced directories |
| CN101184097A (en) * | 2007-12-14 | 2008-05-21 | 北京大学 | Method of detecting worm activity based on flux information |
| US20100094800A1 (en) * | 2008-10-09 | 2010-04-15 | Microsoft Corporation | Evaluating Decision Trees on a GPU |
| CN102214213A (en) * | 2011-05-31 | 2011-10-12 | 中国科学院计算技术研究所 | Method and system for classifying data by adopting decision tree |
| CN102271090A (en) * | 2011-09-06 | 2011-12-07 | 电子科技大学 | Transport-layer-characteristic-based traffic classification method and device |
-
2012
- 2012-01-09 CN CN201210006268.7A patent/CN102523241B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US5870735A (en) * | 1996-05-01 | 1999-02-09 | International Business Machines Corporation | Method and system for generating a decision-tree classifier in parallel in a multi-processor system |
| US20040230745A1 (en) * | 2003-05-12 | 2004-11-18 | International Business Machines Corporation | Parallel cache interleave accesses with address-sliced directories |
| CN101184097A (en) * | 2007-12-14 | 2008-05-21 | 北京大学 | Method of detecting worm activity based on flux information |
| US20100094800A1 (en) * | 2008-10-09 | 2010-04-15 | Microsoft Corporation | Evaluating Decision Trees on a GPU |
| CN102214213A (en) * | 2011-05-31 | 2011-10-12 | 中国科学院计算技术研究所 | Method and system for classifying data by adopting decision tree |
| CN102271090A (en) * | 2011-09-06 | 2011-12-07 | 电子科技大学 | Transport-layer-characteristic-based traffic classification method and device |
Non-Patent Citations (4)
| Title |
|---|
| RENTAO GU 等: "fast traffic classification in high speed networks", 《CHALLENGES FOR NEXT GENERATION NETWORK OPERATION AND SERVICE MANAGEMENT》, 31 December 2008 (2008-12-31), pages 429 - 432 * |
| STEVEN L.SALZBERG: "C4.5: Programs for Machine Learning by J. Ross Quinlan. Morgan Kaufmann Publishers,Inc.,1993", 《MACHINE LEARNING》, vol. 16, no. 3, 30 September 1994 (1994-09-30), pages 235 - 240 * |
| 韩慧 等: "数据挖掘中决策树算法的最新进展", 《计算机应用研究》, vol. 21, no. 12, 31 December 2004 (2004-12-31) * |
| 颜雪松 等: "数据挖掘的并行策略研究", 《计算机工程与应用》, vol. 39, no. 3, 31 January 2003 (2003-01-31) * |
Cited By (33)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102904890A (en) * | 2012-10-12 | 2013-01-30 | 哈尔滨工业大学深圳研究生院 | State detection method for cloud data packet header |
| CN103209169A (en) * | 2013-02-23 | 2013-07-17 | 北京工业大学 | Network flow filtering system and method based on field programmable gate array (FPGA) |
| CN103209169B (en) * | 2013-02-23 | 2016-03-09 | 北京工业大学 | A kind of network traffics filtration system based on FPGA and method |
| CN104125106A (en) * | 2013-04-23 | 2014-10-29 | 中国银联股份有限公司 | Network purity detection device and method based on classified decision tree |
| CN105637904A (en) * | 2013-12-13 | 2016-06-01 | 瑞典爱立信有限公司 | Traffic coordination for communication sessions involving wireless terminals and server devices |
| CN105637904B (en) * | 2013-12-13 | 2019-11-26 | 瑞典爱立信有限公司 | For the service interworking for the communication session for being related to wireless terminal and server apparatus |
| CN107251537A (en) * | 2015-02-10 | 2017-10-13 | 瑞典爱立信有限公司 | Method and apparatus for data agent |
| CN107251537B (en) * | 2015-02-10 | 2020-07-14 | 瑞典爱立信有限公司 | Method and apparatus for data mediation |
| CN105162663A (en) * | 2015-09-25 | 2015-12-16 | 中国人民解放军信息工程大学 | Online traffic identification method based on flow set |
| CN105162663B (en) * | 2015-09-25 | 2019-02-19 | 中国人民解放军信息工程大学 | A kind of online method for recognizing flux based on adfluxion |
| CN106408007A (en) * | 2016-09-07 | 2017-02-15 | 国家电网公司 | Power communication network flow classification method and system |
| CN106572486A (en) * | 2016-10-17 | 2017-04-19 | 湖北大学 | Handheld terminal traffic identification method and system based on machine learning |
| CN106572486B (en) * | 2016-10-17 | 2020-11-27 | 湖北大学 | Handheld terminal flow identification method and system based on machine learning |
| CN106975617A (en) * | 2017-04-12 | 2017-07-25 | 北京理工大学 | A kind of Classification of materials method based on color selector |
| CN106975617B (en) * | 2017-04-12 | 2018-10-23 | 北京理工大学 | A kind of Classification of materials method based on color selector |
| CN107391912A (en) * | 2017-07-04 | 2017-11-24 | 大连大学 | The hospital clinical operation data system of selection for the size stream classification applied in cloud data center system |
| CN108304164A (en) * | 2017-09-12 | 2018-07-20 | 马上消费金融股份有限公司 | A kind of development approach and development system of service logic |
| CN108229573A (en) * | 2018-01-17 | 2018-06-29 | 北京中星微人工智能芯片技术有限公司 | Classified calculating method and apparatus based on decision tree |
| CN109086815A (en) * | 2018-07-24 | 2018-12-25 | 中国人民解放军国防科技大学 | Floating point number discretization method in decision tree model based on FPGA |
| CN109063777A (en) * | 2018-08-07 | 2018-12-21 | 北京邮电大学 | Net flow assorted method, apparatus and realization device |
| CN109246095A (en) * | 2018-08-29 | 2019-01-18 | 四川大学 | A kind of communication data coding method suitable for deep learning |
| CN109784370A (en) * | 2018-12-14 | 2019-05-21 | 中国平安财产保险股份有限公司 | Data map generation method, device and computer equipment based on decision tree |
| CN110445689A (en) * | 2019-08-15 | 2019-11-12 | 平安科技（深圳）有限公司 | Identify the method, apparatus and computer equipment of internet of things equipment type |
| CN110445689B (en) * | 2019-08-15 | 2022-03-18 | 平安科技（深圳）有限公司 | Method and device for identifying type of equipment of Internet of things and computer equipment |
| CN112887300A (en) * | 2021-01-22 | 2021-06-01 | 北京交通大学 | Data packet classification method |
| CN113240036A (en) * | 2021-05-28 | 2021-08-10 | 北京达佳互联信息技术有限公司 | Object classification method and device, electronic equipment and storage medium |
| CN113240036B (en) * | 2021-05-28 | 2023-11-07 | 北京达佳互联信息技术有限公司 | Object classification method and device, electronic equipment and storage medium |
| CN113360740A (en) * | 2021-06-04 | 2021-09-07 | 上海天旦网络科技发展有限公司 | Data packet labeling method and system |
| CN113810311A (en) * | 2021-09-14 | 2021-12-17 | 北京左江科技股份有限公司 | Data packet classification method based on multiple decision trees |
| CN114900474A (en) * | 2022-05-05 | 2022-08-12 | 鹏城实验室 | Data packet classification method, system and related equipment for programmable switch |
| CN114900474B (en) * | 2022-05-05 | 2023-08-22 | 鹏城实验室 | Data packet classification method, system and related equipment for programmable switch |
| CN116226893A (en) * | 2023-05-09 | 2023-06-06 | 北京明苑风华文化传媒有限公司 | Client marketing information management system based on Internet of things |
| CN116521963A (en) * | 2023-07-04 | 2023-08-01 | 北京智麟科技有限公司 | Method and system for processing calculation engine data based on componentization |
Also Published As
| Publication number | Publication date |
|---|---|
| CN102523241B (en) | 2014-11-19 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN102523241B (en) | Method and device for classifying network traffic on line based on decision tree high-speed parallel processing | |
| CN105871832B (en) | A kind of network application encryption method for recognizing flux and its device based on protocol attribute | |
| CN102315974B (en) | Stratification characteristic analysis-based method and apparatus thereof for on-line identification for TCP, UDP flows | |
| US8797901B2 (en) | Method and its devices of network TCP traffic online identification using features in the head of the data flow | |
| CN104982013B (en) | A kind of method, equipment and the system of business routing | |
| CN104270392B (en) | A kind of network protocol identification method learnt based on three grader coorinated trainings and system | |
| CN102244593A (en) | Network communication at unaddressed network devices | |
| CN104125167A (en) | Flow control method and device | |
| CN104102700A (en) | Categorizing method oriented to Internet unbalanced application flow | |
| CN104144089A (en) | BP-neural-network-based method for performing traffic identification | |
| CN108462707A (en) | A kind of mobile application recognition methods based on deep learning sequence analysis | |
| CN106453143A (en) | Bandwidth setting method, device and system | |
| CN108460423B (en) | Service identification method based on SDN architecture | |
| CN110034970A (en) | The network equipment distinguishes method of discrimination and device | |
| CN108141387A (en) | The length of packet header sampling is controlled | |
| CN116668380A (en) | Message processing method and device of convergence diverter equipment | |
| CN102648604B (en) | By means of the method for the descriptive metadata monitoring network traffic | |
| CN101764754B (en) | Sample acquiring method in business identifying system based on DPI and DFI | |
| Hayes et al. | Online identification of groups of flows sharing a network bottleneck | |
| US20150058466A1 (en) | Device for server grouping | |
| WO2015075862A1 (en) | Network control device, network control method, and program | |
| CN101674192B (en) | Method for identifying VoIP based on flow statistics | |
| CN106385460A (en) | Programmable architecture of Internet of things | |
| KR20120085400A (en) | Packet Processing System and Method by Prarllel Computation Based on Hadoop | |
| KR100893026B1 (en) | Packet Analysis Apparatus for classifying page of IP packet and thereof method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant |