CN104468252A - Intelligent network service identification method based on positive transfer learning - Google Patents
Intelligent network service identification method based on positive transfer learning Download PDFInfo
- Publication number
- CN104468252A CN104468252A CN201310433157.9A CN201310433157A CN104468252A CN 104468252 A CN104468252 A CN 104468252A CN 201310433157 A CN201310433157 A CN 201310433157A CN 104468252 A CN104468252 A CN 104468252A
- Authority
- CN
- China
- Prior art keywords
- network
- module
- packet
- dfi
- dpi
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Abstract
The invention provides an intelligent network service identification method based on positive transfer learning, which can improve analysis efficiency and accuracy of network services. In the field of network data transmission, in network service identification and management methods, deep packet inspection (DPI) and dynamic flow inspection (DFI) have low network service identification rate, a feature library is not updated timely, the overall identification efficiency is low, and non-real time off-line detection and analysis cannot be realized. The network service is detected and identified by parallel detection of DPI and DFI rather than by common serial mode thereof in the prior art, so that identification efficiency of the network service is improved. The DPI judges service types by an identification technology of tagged word, and the feature library needs to be updated timely and rapidly, so that the DPI feature library is established and updated by the positive transfer learning. The network service which cannot be identified by DFI can be detected by a relevant flow detection module, so that the service identification efficiency of the overall system can be further improved.
Description
Technical field
The present invention devises a kind of Network identification and method for controlling network flow, describes a kind of intelligent network services recognition methods based on positive transfer study especially, belongs to field of network data transmission.
Background technology
Because the Internet has opening, interactivity and equality, meet shared, the quick and open demand of people for information, so promoted the development of network technology, and then also promote Network and constantly increase sharply.The such as now wider emerging service of application has P2P, online game, Internet video etc., these business occupy the Internet nearly 2/3 bandwidth, cause link aggregation to arrive the anxiety of the bandwidth resources of core network interface link.When a large amount of download software and Online Video run simultaneously, network congestion may be caused because taking the too many network bandwidth, and then cause the decline of network performance and the reduction of network service quality, can not qos requirement be met.Therefore Virtual network operator and network manager are in the urgent need to a kind of system can monitored Network, identify and manage.
And at present, traditional detection method (i.e. Port detecting method), deep-packet detection method (Deep Packet Inspection is mainly contained for Network recognition methods, DPI) with based on the detection method (be also called the degree of depth/dynamic flow and detect Deep/Dynamic Flow Inspection, DFI) etc. of stream feature.The present invention improves mainly for the Network Recognition method that DPI and DFI carries out and produces.DPI is checking network network layers and transport layer data packet header not only, and is deep in the content packaged by payload of application layer data bag, searches legal or illegal content to determine whether allow packet to pass through.So, the agreement of DPI None-identified unknown characteristic and encipher flux, then DFI arises at the historic moment.DFI is a kind of newer protocol identification method, by the network layer of session stream and transport layer information, as Business Stream duration, average discharge, the isoparametric statistical analysis of discrepancy linking number carry out identification protocol type.DFI, without the need to the application layer of resolution data bag, can say that DFI is the supplementary method of identification of DPI.Due to only to flow behavioural analysis, so DFI generally can only classify to application type.But DPI depends on the discrimination to packet for network service controlling precision, need to constantly update protocol library to improve discrimination, and be that each packet is processed, increase hardware handles burden, cause the unstable networks that throughput is high.
Transfer learning method utilizes the application to known knowledge, the learning method obtaining and acquire new knowledge.Mainly be divided into positive transfer learning method and negative transfer learning method.Positive transfer learning method is that a kind of known study plays a driving role to another unknown study, and negative transfer learning rule has been inhibition.Do not adopt the foundation of positive transfer learning method, maintenance features storehouse in existing network network traffic identification, therefore the present invention adopts the method to set up, upgrades DPI feature database.Namely according to the requirement of new problem, select, by learning the feature obtained, to be applicable to a kind of process of new problem from the feature database set up, and its application can be monitored when solving new problem, and then improve the ability that feature database carries out according to existing strategy learning, improve the renewal rate of feature database.
Summary of the invention
Slow in order to solve Network recognition rate in existing Method and Technology, feature database upgrades not in time, overall discrimination is low and cannot accomplish the problems such as non real-time offline inspection and analysis, improve analysis efficiency and the accuracy of Network, the present invention proposes a kind of intelligent network services recognition methods based on transfer learning.The present invention is based on the intelligent network services recognition methods of transfer learning, comprise the following steps:
(1) utilize packet capturing software from network, catch the packet needing identification, import coarseness classification protocol module and carry out preliminary classification;
(2) coarseness sort out protocol module whether encrypt according to packet or protocol characteristic whether known, packet is carried out coarseness classification: restricted data bag and open data packet.Open data packet is the packet that can be identified by feature detection; Restricted data Bao Ze is the packet of encryption or unknown characteristic;
(3) open data packet is directly sent to DPI module and carries out detection identification, restricted data bag passes to DFI module.Packet in DPI module and DFI module is parallel and carry out independently operating, identifying;
(4) packet received is carried out process of unpacking by DPI module, extract feature string (being the combination of bytes that position occurs in application layer load), mate with backstage feature database (set up by positive transfer learning method, upgrade), judge class of service according to matching result, the Packet Generation of identification is carried out forwarding operation to output module; Unidentified packet generates and detects failure reporting, gives subscriber administration interface and determines whether abandon;
(5) after DFI module receives restricted data bag, DFI does not carry out process of unpacking, the stream label in direct network flow calculation and flow detection model (detection model formed by statistical natures such as flow duration, the sizes the being connected average packet) comparison in DFI module.Comparison is identical, by the Packet Generation of identification to detecting output module; Do not mate, unidentified Packet Generation is given association stream detection module;
(6) association stream detection module does not need operation of unpacking, by realizing non real-time offline inspection to network flow characteristic identification.First the network traffics of some times, space attribute similitude are associated, obtain correlation diagram, compared with the network traffics identified.Even network traffics A is the application type identified, then, in the life span of A, have unrecognized network traffics B, and B and A flows correlation degree in threshold value, then can judge B also as this application type.And then identify unknown network discharge pattern.If exceed threshold value, explanation can not identify this type of service, determines whether abandon by packet being given subscriber administration interface;
(7) according to the testing result that each detection module exports, the packet identified is sorted out and is put into temporary cache in the exclusive buffering area of various application type, then by certain bandwidth control strategy, Packet Generation is gone out; Unidentified packet is generated and detects failure reporting, send to subscriber administration interface, determine whether to need to continue to send according to user's request.
Adopt the method for DPI and DFI parallel detection to detect Network, identify, instead of in prior art, conventional serial mode realizes the combination of two kinds of methods, thus improve the recognition efficiency to Network.Have employed the feature database that positive transfer learning method is set up, upgraded DPI, improve the speed that feature database is set up, upgraded.Moreover for the Network of DFI None-identified, adopt association stream detection module to detect.The network flow group of this module be to generate using known business type as with reference to Sample Establishing, improve the traffic identification ability of total system further.
Accompanying drawing explanation
Accompanying drawing 1 is the intelligent network services recognition methods operating procedure flow chart based on transfer learning.
Accompanying drawing 2 is the foundation of DPI feature database and upgrades block diagram.
Accompanying drawing 3 is the intelligent network services recognition methods operating process flow chart based on transfer learning.
The drawings and specific embodiments are described further the intelligent network services recognition methods that the present invention is based on transfer learning below.
Embodiment
Accompanying drawing 1 is for the present invention is based on the intelligent network services recognition methods operating procedure flow chart of transfer learning.As seen from the figure, the present invention is based on the intelligent network services recognition methods of transfer learning, comprise the following steps:
(1) from network, catch the packet needing to identify with packet capturing software, import coarseness classification protocol module and carry out preliminary classification;
(2) coarseness sort out protocol module whether encrypt according to packet or protocol characteristic whether known, packet is carried out coarseness classification: restricted data bag and open data packet.Open data packet is the packet that can be identified by feature detection; Restricted data Bao Ze is the packet of encryption and unknown characteristic;
(3) open data packet is directly sent to DPI module and carries out detection identification, restricted data bag passes to DFI module.Packet in DPI module and DFI module is parallel and carry out independently operating, identifying;
(4) packet received is carried out process of unpacking by DPI module, extract feature string, mate with backstage feature database, class of service is judged according to matching result, the Packet Generation of identification is carried out forwarding operation to output module, Unidentified packet generates and detects failure reporting, gives subscriber administration interface and determines whether abandon;
(5) after DFI module receives restricted data bag, DFI does not carry out process of unpacking, the flow detection model comparison in the stream label in direct network flow calculation and DFI module.Comparison is identical, by the Packet Generation of identification to detecting output module; Do not mate, unidentified Packet Generation is given association stream detection module;
(6) association stream detection module does not need operation of unpacking, by realizing non real-time offline inspection to network flow characteristic identification.First the network traffics of some times, space attribute similitude are associated, obtain correlation diagram, compared with the network traffics identified.Even network traffics A is the application type identified, then, in the life span of A, have unrecognized network traffics B, and B and A flows correlation degree in threshold value, then can judge B also as this application type.And then identify unknown network discharge pattern;
(7) according to the testing result that each detection module exports, the packet identified is sorted out and is put into temporary cache in the exclusive buffering area of various application type, then by certain bandwidth control strategy, Packet Generation is gone out; Unidentified packet is generated and detects failure reporting, send to subscriber administration interface, determine whether to need to continue to send according to user's request.
Accompanying drawing 2 is set up for DPI feature database and is upgraded block diagram.As seen from the figure, from training data (i.e. off-line data or the data that utilize packet capturing software to obtain), extract feature string send into study module, study module will have feature database (as protocol type, port address, transmission time, the feature database that the mark business-type keyword such as each layer data bag size is formed) in data and parameter in positive transfer learning algorithm through mathematical operation, whether can be identified according to obtaining operation result judging characteristic character string, and as the feature string sample in new standard feature storehouse.Realize the function being upgraded DPI feature database by positive transfer learning method.Namely utilize that existing feature samples is analyzed unknown sample, modeling, such as parameter similarity degree both contrast, or several known business type feature sample is through integrating, developing the feature samples formed, this type of service known is among this several known business type, thus obtain the feature samples judging this type of service, set up corresponding feature database, the foundation of feature database, renewal can be completed.
Accompanying drawing 3 is the intelligent network services recognition methods operating process flow chart based on transfer learning.As seen from the figure, first, data intercept bag from transmission network, whether encrypt according to packet or feature whether known carry out coarseness classification process, be divided into open data packet and restricted data bag.Open data packet is can by the packet of feature detection identification; Restricted data Bao Ze is the packet of encryption and unknown characteristic.Judge whether packet is open data packet, if result is yes, then by Packet Generation to DFI module.Due to detect application layer data bag payload packaged by content, then carry out process of unpacking, extract feature string, adopt fast finding method from the feature database set up by positive transfer learning method, recall the feature string comparison of similar feature field and extraction.Determine whether that coupling completes again.Do not complete, then continue coupling; Otherwise, again judge that whether matching result is identical.If not identical, generate and detect failure reporting, be supplied to the foundation that user makes a policy; Otherwise, illustrate that DPI detection module identifies type of service, generate concrete type of service report.The packet of identification is sent from corresponding port, completes the testing of DPI module.
If packet is not open data packet, then carry out DFI detection, it is carry out that this process and DPI detect simultaneously.From restricted data bag, search flow label and add up, with flow detection Model Matching.If do not mated, association stream detection module is sent to carry out offline inspection; Otherwise DFI identifies network traffic types, can send from corresponding port, complete the detection operation of DFI module.
When DFI module can not correctly Sampling network business time, Packet Generation is detected to the association flow module under off-line state.First extract some times, the network traffics of space attribute similitude associate, form network flow correlation diagram, and contrast with the network traffics group identified.If network flow correlation diagram and the known network stream group degree of association, in threshold value, draw type of service, send from corresponding port; Otherwise, generate and detect failure reporting, for user provides the foundation of decision-making.
Claims (4)
1.
claim 1:based on an intelligent network services recognition methods for positive transfer study, it is characterized in that: the method comprises the following steps:
(1) utilize packet capturing software from network, catch the packet needing identification, import coarseness and sort out protocol module, carry out preliminary classification;
(2) coarseness sort out protocol module whether encrypt according to packet or protocol characteristic whether known, packet is carried out coarseness classification: restricted data bag and open data packet, open data packet is the packet that can be identified by feature detection; Restricted data Bao Ze is the packet of encryption and unknown characteristic;
(3) open data packet is directly sent to DPI module to carry out detection and identify, restricted data bag passes to DFI module, and the packet in DPI module and DFI module is parallel and carry out independently operating, identifying;
(4) packet received is carried out process of unpacking by DPI module, extract feature string, mate with backstage feature database (set up by positive transfer learning method, upgrade), judge class of service according to matching result, the Packet Generation of identification is carried out forwarding operation to output module; Unidentified packet generates and detects failure reporting, gives subscriber administration interface and determines whether abandon;
(5) after DFI module receives restricted data bag, DFI does not carry out process of unpacking, stream label in direct network flow calculation and flow detection model (detection model formed by statistical natures such as flow duration, the sizes the being connected average packet) comparison in DFI module, comparison is identical, explanation identifies network traffic types, then by the Packet Generation of identification to detecting output module; Otherwise unidentified Packet Generation is given association stream detection module;
(6) association stream detection module does not need operation of unpacking, by realizing non real-time offline inspection to network flow characteristic identification, first the network traffics of some times, space attribute similitude are associated, obtain correlation diagram, compared with the network traffics group identified, even network traffics A is the type of service identified, then in the life span of A, there is unrecognized network traffics B, and B and A flows correlation degree in threshold value, then can judge B also as this type of service, and then identify the Unidentified type of service of DFI;
(7) according to the testing result that each detection module exports, the packet identified is sorted out and is put into temporary cache in the exclusive buffering area of various application type, then by certain bandwidth control strategy, Packet Generation is gone out, Unidentified packet is generated and detects failure reporting, send to subscriber administration interface, determine whether to need to continue to send according to user's request, the method of DPI and DFI parallel detection is adopted to detect Network, identify, instead of conventional serial mode realizes the combination of two kinds of methods in prior art, thus the recognition efficiency improved Network, positive transfer learning method is adopted to set up, upgrade the feature database of DPI, improve feature database to set up, the speed upgraded, to the Network of DFI None-identified, association stream detection module is adopted to detect, the traffic identification ability of further raising total system.
2.
claim 2:according to claim 1 based on the intelligent network services recognition methods of positive transfer study, it is characterized in that: DPI module is that feature based character string recognition technology carrys out recognition network type of service, the foundation of feature database, upgrading in time to have hysteresis quality too of a specified duration, so the present invention proposes the method setting up, upgrade the feature database in DPI module based on transfer learning method; Concrete steps are as follows: first obtain training data (i.e. off-line data or the data that utilize packet capturing software to obtain), from training data, extract feature string send into study module, study module utilizes the data in existing feature database, upgrades DPI feature database by positive transfer learning method; Namely utilize that existing feature samples is analyzed unknown sample, modeling, such as parameter similarity degree both contrast, or several known business type feature sample is through integrating, developing the feature samples formed, this type of service known is among this several known business type, thus obtain the feature samples judging this type of service, set up corresponding feature database, the foundation of feature database, renewal can be completed.
3.
claim 3:according to claim 1 based on the intelligent network services recognition methods of positive transfer study, it is characterized in that: first whether Network to be encrypted according to packet and whether feature is known carries out coarseness classification, transmission open data packet and restricted data bag are respectively to DPI module and DFI module, two modular concurrent detect type of service, DPI module needs to be deep in the load of application layer through process of unpacking layer by layer accurately to detect feature string, ability recognition network business, detection rates is slower in this approach in institute, but identify precisely, and DFI module does not need to unpack process directly proposition feature stream label and the comparison of flow detection model, make DFI module detection rates faster, but general identification can only be carried out to application type, not only improve the accuracy of Network identification so both combinations are realized parallel processing by the present invention but also the recognition efficiency of Network can be improved.
4.
claim 4:according to claim 1 based on the intelligent network services recognition methods of positive transfer study, it is characterized in that: send to association stream detection module to carry out offline mode for the Unidentified Network of DFI module and detect identification, identified off-line is adopted to be in existing network business recognition method, mostly adopt online mode to realize on the one hand, if detect mistake may cause the problems such as network congestion, malicious traffic forward wantonly, make troubles to the foundation of theoretical research and detection system; Being to identify the network traffic types that DFI module can not identify further on the other hand, improving Network recognition capability.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310433157.9A CN104468252A (en) | 2013-09-23 | 2013-09-23 | Intelligent network service identification method based on positive transfer learning |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310433157.9A CN104468252A (en) | 2013-09-23 | 2013-09-23 | Intelligent network service identification method based on positive transfer learning |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN104468252A true CN104468252A (en) | 2015-03-25 |
Family
ID=52913661
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201310433157.9A Pending CN104468252A (en) | 2013-09-23 | 2013-09-23 | Intelligent network service identification method based on positive transfer learning |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN104468252A (en) |
Cited By (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105141637A (en) * | 2015-09-25 | 2015-12-09 | 中铁工程装备集团有限公司 | Transmission encryption method taking flows as granularity |
| CN106547915A (en) * | 2016-11-29 | 2017-03-29 | 上海轻维软件有限公司 | Intelligent data extracting method based on model library |
| CN107295572A (en) * | 2016-04-11 | 2017-10-24 | 北京搜狗科技发展有限公司 | A kind of dynamic self-adapting current-limiting method and electronic equipment |
| CN111049757A (en) * | 2018-10-12 | 2020-04-21 | 华为技术有限公司 | Service flow processing method and device |
| CN111835660A (en) * | 2020-07-24 | 2020-10-27 | 西安翻译学院 | Deep data packet detection method and device |
| CN111931797A (en) * | 2019-05-13 | 2020-11-13 | 中国移动通信集团湖南有限公司 | Method, device and equipment for identifying network to which service belongs |
| CN112383489A (en) * | 2020-11-16 | 2021-02-19 | 中国信息通信研究院 | Network data traffic forwarding method and device |
| CN112564834A (en) * | 2020-11-09 | 2021-03-26 | 中国运载火箭技术研究院 | Intelligent cognition and interference method and system for wireless communication system |
| CN113691562A (en) * | 2021-09-15 | 2021-11-23 | 神州网云（北京）信息技术有限公司 | Method for implementing rule engine for accurately identifying malicious network communication |
| CN115277587A (en) * | 2022-07-29 | 2022-11-01 | 中国电信股份有限公司 | Network traffic identification method, device, equipment and medium |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101605067A (en) * | 2009-04-22 | 2009-12-16 | 网经科技（苏州）有限公司 | Network behavior active analysis diagnostic method |
| CN101645806A (en) * | 2009-09-04 | 2010-02-10 | 东南大学 | Network flow classifying system and network flow classifying method combining DPI and DFI |
| US7996520B2 (en) * | 2007-09-19 | 2011-08-09 | Cisco Technology, Inc. | Behavioral classification of communication sessions using active session initiation |
| CN102201982A (en) * | 2011-04-29 | 2011-09-28 | 北京网康科技有限公司 | Application identification method and equipment thereof |
| WO2012067528A1 (en) * | 2010-11-15 | 2012-05-24 | Hch Sp. Z O.O. | Manner of obtainment of mass for production of shaped construction elements and mass for production of shaped construction elements |
| KR20120067528A (en) * | 2010-12-16 | 2012-06-26 | 엘지에릭슨 주식회사 | Method for self studying of rule and lte system for the same |
-
2013
- 2013-09-23 CN CN201310433157.9A patent/CN104468252A/en active Pending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7996520B2 (en) * | 2007-09-19 | 2011-08-09 | Cisco Technology, Inc. | Behavioral classification of communication sessions using active session initiation |
| CN101605067A (en) * | 2009-04-22 | 2009-12-16 | 网经科技（苏州）有限公司 | Network behavior active analysis diagnostic method |
| CN101645806A (en) * | 2009-09-04 | 2010-02-10 | 东南大学 | Network flow classifying system and network flow classifying method combining DPI and DFI |
| WO2012067528A1 (en) * | 2010-11-15 | 2012-05-24 | Hch Sp. Z O.O. | Manner of obtainment of mass for production of shaped construction elements and mass for production of shaped construction elements |
| KR20120067528A (en) * | 2010-12-16 | 2012-06-26 | 엘지에릭슨 주식회사 | Method for self studying of rule and lte system for the same |
| CN102201982A (en) * | 2011-04-29 | 2011-09-28 | 北京网康科技有限公司 | Application identification method and equipment thereof |
Cited By (15)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105141637A (en) * | 2015-09-25 | 2015-12-09 | 中铁工程装备集团有限公司 | Transmission encryption method taking flows as granularity |
| CN107295572A (en) * | 2016-04-11 | 2017-10-24 | 北京搜狗科技发展有限公司 | A kind of dynamic self-adapting current-limiting method and electronic equipment |
| CN106547915A (en) * | 2016-11-29 | 2017-03-29 | 上海轻维软件有限公司 | Intelligent data extracting method based on model library |
| CN106547915B (en) * | 2016-11-29 | 2019-10-29 | 上海轻维软件有限公司 | Intelligent data extracting method based on model library |
| CN111049757A (en) * | 2018-10-12 | 2020-04-21 | 华为技术有限公司 | Service flow processing method and device |
| CN111049757B (en) * | 2018-10-12 | 2022-03-01 | 华为技术有限公司 | Service flow processing method and device |
| CN111931797A (en) * | 2019-05-13 | 2020-11-13 | 中国移动通信集团湖南有限公司 | Method, device and equipment for identifying network to which service belongs |
| CN111931797B (en) * | 2019-05-13 | 2023-09-08 | 中国移动通信集团湖南有限公司 | Method, device and equipment for identifying network to which service belongs |
| CN111835660A (en) * | 2020-07-24 | 2020-10-27 | 西安翻译学院 | Deep data packet detection method and device |
| CN112564834A (en) * | 2020-11-09 | 2021-03-26 | 中国运载火箭技术研究院 | Intelligent cognition and interference method and system for wireless communication system |
| CN112564834B (en) * | 2020-11-09 | 2023-02-03 | 中国运载火箭技术研究院 | Intelligent cognition and interference method and system for wireless communication system |
| CN112383489A (en) * | 2020-11-16 | 2021-02-19 | 中国信息通信研究院 | Network data traffic forwarding method and device |
| CN113691562A (en) * | 2021-09-15 | 2021-11-23 | 神州网云（北京）信息技术有限公司 | Method for implementing rule engine for accurately identifying malicious network communication |
| CN115277587A (en) * | 2022-07-29 | 2022-11-01 | 中国电信股份有限公司 | Network traffic identification method, device, equipment and medium |
| CN115277587B (en) * | 2022-07-29 | 2023-10-31 | 中国电信股份有限公司 | Network traffic identification method, device, equipment and medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104468252A (en) | Intelligent network service identification method based on positive transfer learning | |
| CN110753064B (en) | Machine learning and rule matching fused security detection system | |
| CN101741744B (en) | Network flow identification method | |
| CN101645806B (en) | Network flow classifying system and network flow classifying method combining DPI and DFI | |
| CN107665191B (en) | Private protocol message format inference method based on extended prefix tree | |
| WO2021227322A1 (en) | Ddos attack detection and defense method for sdn environment | |
| CN104270392B (en) | A kind of network protocol identification method learnt based on three grader coorinated trainings and system | |
| CN101414939B (en) | Internet application recognition method based on dynamical depth package detection | |
| CN103312565B (en) | A kind of peer-to-peer network method for recognizing flux based on autonomous learning | |
| CN101252541B (en) | Method for establishing network flow classified model and corresponding system thereof | |
| CN102571946B (en) | Realization method of protocol identification and control system based on P2P (peer-to-peer network) | |
| CN107623754B (en) | WiFi acquisition system and method based on authenticity MAC identification | |
| WO2011130957A1 (en) | Method and apparatus for online distinguishing transmission control protocol traffic by using data flow head characteristics | |
| CN102315974A (en) | Stratification characteristic analysis-based method and apparatus thereof for on-line identification for TCP, UDP flows | |
| CN106330584A (en) | Identification method and identification device of business flow | |
| CN107819646A (en) | A kind of net flow assorted system and method for distributed transmission | |
| CN101997700A (en) | Internet protocol version 6 (IPv6) monitoring equipment based on deep packet inspection and deep flow inspection | |
| CN110532564A (en) | A kind of application layer protocol online recognition method based on CNN and LSTM mixed model | |
| CN102739457A (en) | Network flow recognition system and method based on DPI (Deep Packet Inspection) and SVM (Support Vector Machine) technology | |
| CN109299742A (en) | Method, apparatus, equipment and the storage medium of automatic discovery unknown network stream | |
| CN105871619A (en) | Method for n-gram-based multi-feature flow load type detection | |
| CN111611280A (en) | Encrypted traffic identification method based on CNN and SAE | |
| CN110958233A (en) | Encryption type malicious flow detection system and method based on deep learning | |
| CN110213280A (en) | Ddos attack detection method based on LDMDBF under a kind of SDN environment | |
| Kong et al. | Identification of abnormal network traffic using support vector machine |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| WD01 | Invention patent application deemed withdrawn after publication | ||
| WD01 | Invention patent application deemed withdrawn after publication |
Application publication date: 20150325 |