A Method of Network Traffic Identification Based on Improved Clustering Algorithms

J4 ›› 2011, Vol. 33 ›› Issue (11): 10-14.

• 论文 • Previous Articles Next Articles

A Method of Network Traffic Identification Based on Improved Clustering Algorithms

WANG Yuke1,LI Wenwei2,SU Xin2

(1.Center of Network Information,Hunan University,Changsha 410082;
2.School of Information Science and Engineering,Hunan University,Changsha 410082,China)

Received:2011-06-03 Revised:2011-09-04 Online:2011-11-25 Published:2011-11-25

Abstract

Abstract:

The automatic detection of applications associated with network traffic is very important for network security and traffic management. Unfortunately, because of some of the applications like P2P, VOIP applications using dynamic port numbers, masquerading techniques, and encryption, it is difficult using simple portbased analysis to classify packet payloads in order to identify these applications. And many research works have proposed using the clustering algorithms to identify network traffic, but these algorithms have some defects in how to choose the cluster center and the number of clusters. In this paper, we first use the Weighting D2 algorithm to improve the selection of the initialized cluster centers, and use the value of NMI(Normalize Mutual Information)to ascertain the number of clusters, and then get an improved clustering algorithm, and finally propose a application level identification method based on this algorithm. The experimental results show that this method reaches 90% accuracy or more, and gets lower False Positive Rate and False Rejection Rate.

Key words: traffic identification;clustering algorithm;center of cluster;number of cluster

WANG Yuke1,LI Wenwei2,SU Xin2. A Method of Network Traffic Identification Based on Improved Clustering Algorithms[J]. J4, 2011, 33(11): 10-14.

References

［1］Moore A,Zuev D.Internet Traffic Classification Using Bayesian Analysis［C］∥Proc of ACM SIGMETRICS’05, 2005:5060.
［2］Karagiannis T, Papagiannaki D, Faloutsos M. BLINC: Multilevel Traffic Classification in the Dark［C］∥Proc of ACM SIGCOMM’05, 2005:229240.
［3］焦小焦,钟诚,杨柳,等. 基于流量特征和载荷特征的P2P流量识别［J］. 计算机工程与科学, 2010,32(8):2428.
［4］胡庆安,吴明慧. 基于双重特征的协议识别方法［J］.计算机安全, 2010(3):67.
［5］Baset A, Schulzrinne H. An Analysis of the Skype PeertoPeer Internel Telephony Protocol［R］. Technical Report CUCS03904,Columbia University, 2004.
［6］McGregor A, Hall M, Lorier P, et al.Flow Clustering Using Machine Learning Techniques［C］∥Proc of PAM’04, 2004:205214.
［7］Dempster A P, Paird N M, Rubin D B. Maximum Likelihood from Incomplete Data via the EM Algorithm［J］. Journal of the Royal Statistical Society, 1977,39(1):138.
［8］Duffield N,Lund C. Predicting Resource Usage and Estimation Accuracy in an IP Flow Measurement Collection Infrastructure［C］∥Proc of ACM Internet Measurement Conference, 2003:8596.
［9］Erman J, Arlitt M, Mahanti A. Traffic Classification Using Clustering Algorithms［C］∥Proc of ACM SIGCOMM’06, 2006.
［10］Bernaille L, Teixeira R, Akodkenou I, et al. Traffic Classification on the Fly［J］. ACM SIGCOMM Computer Communication Review, 2006,36(2):2326.
［11］马永立,钱宗珏,寿国础,等. 机器学习用于网络流量识别［J］. 北京邮电大学学报, 2009, 32(1):6568.
［12］苏欣，杨建华，张大方，等. 面向流量识别系统的聚类算法的比较和分析［J］.计算技术与自动化, 2008, 27(3):14.
［13］MacQueen J. Some Methods for Classification and Analysis of Multivariate Observations［C］∥Proc of the Fifth Berkeley Symposium on Mathematical Statistics and Probability, 1967:281297.
［14］Arthur D, Vassilvitskii S. Kmeans++: The Advantages of Careful Seeding［C］∥Proc of SODA’07,2007:10271035.
［15］Bernaille L, Teixeira R, Salamatian K. Early Application Identification［C］∥Proc of CONEXT’06, 2006:112.
［16］Boyer R, Moore J. A Fast String Searching Algorithm［J］. Communications of the ACM, 1977,20(10):762777.

A Method of Network Traffic Identification Based on Improved Clustering Algorithms

PDF

Knowledge

Abstract

Cite this article

share this article

References

Related Articles 0

Recommended Articles

Metrics

Comments