CN109450740A - SDN controller for carrying out traffic classification based on DPI and machine learning algorithm - Google Patents
SDN controller for carrying out traffic classification based on DPI and machine learning algorithm Download PDFInfo
- Publication number
- CN109450740A CN109450740A CN201811574511.9A CN201811574511A CN109450740A CN 109450740 A CN109450740 A CN 109450740A CN 201811574511 A CN201811574511 A CN 201811574511A CN 109450740 A CN109450740 A CN 109450740A
- Authority
- CN
- China
- Prior art keywords
- module
- dpi
- machine learning
- data packet
- learning algorithm
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000004422 calculation algorithm Methods 0.000 title claims abstract description 55
- 238000010801 machine learning Methods 0.000 title claims abstract description 30
- 238000012549 training Methods 0.000 claims abstract description 17
- 238000005516 engineering process Methods 0.000 claims abstract description 15
- 238000000605 extraction Methods 0.000 claims abstract description 10
- 230000006870 function Effects 0.000 claims abstract description 7
- 238000000034 method Methods 0.000 claims description 13
- 238000004458 analytical method Methods 0.000 claims description 6
- 238000012360 testing method Methods 0.000 claims description 6
- 230000004044 response Effects 0.000 claims description 3
- 230000009471 action Effects 0.000 claims description 2
- 235000014510 cooky Nutrition 0.000 claims description 2
- 230000007246 mechanism Effects 0.000 abstract description 4
- 238000010276 construction Methods 0.000 abstract description 2
- 238000007689 inspection Methods 0.000 abstract description 2
- 238000003064 k means clustering Methods 0.000 abstract 1
- 238000001514 detection method Methods 0.000 description 3
- 238000012423 maintenance Methods 0.000 description 2
- 230000006855 networking Effects 0.000 description 2
- 230000003044 adaptive effect Effects 0.000 description 1
- 230000006399 behavior Effects 0.000 description 1
- 230000015572 biosynthetic process Effects 0.000 description 1
- 238000004364 calculation method Methods 0.000 description 1
- 238000007635 classification algorithm Methods 0.000 description 1
- 239000011248 coating agent Substances 0.000 description 1
- 238000000576 coating method Methods 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 230000000052 comparative effect Effects 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000012804 iterative process Methods 0.000 description 1
- 238000013507 mapping Methods 0.000 description 1
- 230000008569 process Effects 0.000 description 1
- 238000010200 validation analysis Methods 0.000 description 1
- 239000002699 waste material Substances 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/02—Capturing of monitoring data
- H04L43/026—Capturing of monitoring data using flow identification
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
- G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
- G06F18/2155—Generating training patterns; Bootstrap methods, e.g. bagging or boosting characterised by the incorporation of unlabelled data, e.g. multiple instance learning [MIL], semi-supervised techniques using expectation-maximisation [EM] or naïve labelling
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/23—Clustering techniques
- G06F18/232—Non-hierarchical techniques
- G06F18/2321—Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions
- G06F18/23213—Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions with fixed number of clusters, e.g. K-means clustering
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/241—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches
- G06F18/2415—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches based on parametric or probabilistic models, e.g. based on likelihood ratio or false acceptance rate versus a false rejection rate
- G06F18/24155—Bayesian classification
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/02—Capturing of monitoring data
- H04L43/028—Capturing of monitoring data by filtering
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L47/00—Traffic control in data switching networks
- H04L47/10—Flow control; Congestion control
- H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
- H04L47/2441—Traffic characterised by specific attributes, e.g. priority or QoS relying on flow classification, e.g. using integrated services [IntServ]
Landscapes
- Engineering & Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Bioinformatics & Computational Biology (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Evolutionary Biology (AREA)
- Evolutionary Computation (AREA)
- Artificial Intelligence (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Life Sciences & Earth Sciences (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Probability & Statistics with Applications (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses an SDN controller for classifying traffic based on DPI and machine learning algorithm, which realizes the function of classifying application requests of traffic data packets by combining a DPI mechanism and the machine learning algorithm by adding a self-established module in the existing controller module, wherein the self-established module mainly comprises three parts: a data stream characteristic construction module; a feature extraction and classifier training module; and the classifier carries out a flow classification module. Firstly, constructing an information feature library by using a K-means clustering algorithm, then extracting features by using a DPI (deep packet inspection) technology to form a training module, and finally performing detailed flow classification on a data packet by using a naive Bayes algorithm. The SDN controller for carrying out flow classification based on the DPI and the machine learning algorithm has high classification precision and good flexibility.
Description
Technical field
The present invention relates to a kind of SDN controller, in particular to a kind of combination deep packet inspection technical and machine learning algorithm
Carry out the SDN controller of net flow assorted.
Background technique
SDN (Software Defined Networking, software defined network) is a kind of novel computer network mould
Formula, compared with traditional network architecture system, SDN decouples network control layer and data Layer, has broken hanging down for osi model
Straight frame, Fig. 1 illustrate the structure system figure of SDN network.OpenFlow (OF) agreement is a kind of important communication protocol, control
Device and the network switch processed are interacted by this agreement, and OpenFlow is also most common southbound interface agreement in SDN.OF
Interchanger includes single or multilevel flow table.Flow table is made of stream information.Each flow table contains some rules and to hold
Capable movement.
SDN is considered as a kind of networking paradigms in future, can significantly simplify the operation and maintenance of network, improves network
The utilization rate of resource.However, the granularity of the flow of SDN control at present is perfect not enough.OpenFlow is that data plane and control are flat
Most common interface between face, but it can only be handled in osi model from first layer to the 4th layer of information, and it is unable to aware application
The formation of layer information, therefore the QoS requirement different in face of different application requests, controller can not provide different
Service, thinks deeply again on this basis and redesign SDN traffic engineering has great importance.
In order to realize that fine-grained flow guarantees in SDN, carrying out classification for network flow is an essential step.
There are many kinds of present existing countermeasures, can substantially be divided into three classes:
A) it is based on the traffic classification method of deep-packet detection (DPI) technology.DPI technology can go out data packet with accurate detection
Payload, for application layer protocol carry out cutting identify different application requests.However DPI technology is limited to encryption stream
And some proprietary protocols, and DPI can not provide a standard in the case where existing multiple application request similar services
True classification results；
B) the traffic classification method based on machine learning algorithm.The appearance of machine learning algorithm provides newly for traffic classification
Thinking, compared with DPI technology, it is only necessary to certain main feature items in flow table information not to need for machine learning algorithm
The payload of detection data packet is gone so can classify to encryption stream.However the traffic classification side based on machine learning algorithm
Method is also with the presence of its disadvantage, as the nicety of grading of unsupervised formula machine learning algorithm is low and the complexity of algorithm implementation is high, supervision
Formula machine learning algorithm require all labels be all labeled this is undoubtedly impossible in a real network environment, without
Decoupling control and data plane are excavated and coordinated, Semi-supervised machine learning algorithm cannot be used directly in SDN.
C) based on the traffic classification method of Various Classifiers on Regional mechanism.This method combines several different traffic classification sides
The advantages of method, carries out the classification of flow, however DPI and port numbers recognition mechanism are either combined progress in existing technology
The method of traffic classification still carries out traffic classification using different machine learning algorithms and suffers from both sides limitation, one is
Accuracy is not high, the second is implementation method is inflexible.
Summary of the invention
In order to solve the disadvantage that existing traffic classification method, the present invention devise a kind of based on DPI and machine learning calculation
The SDN controller of method progress traffic classification.
The purpose of the present invention is carry out real-time and adaptive carry out traffic classification by setting module certainly in SDN controller
Fine-grained flow is had reached to guarantee.
The technical solution adopted in the present invention is as follows:
A kind of SDN controller carrying out traffic classification based on DPI and machine learning algorithm, in order to cope with the spirit of network demand
Activity, SDN controller frame structure such as Fig. 2 that the present invention designs, can add parallel in the basis of existing controller
Traffic classification mechanism module is specifically included with lower module:
A, traffic flow information feature database constructs module
B, feature extraction and classifier training module
C, classifier carries out traffic classification module
The function of modules A is to establish a classification for the data packet of different application.In modules A, when controller passes through
Packet_in operation is after obtaining flow table information using the Unsupervised clustering algorithm in machine learning algorithm for asking in interchanger
The cluster operation that the data flow asked is applied, specific implementation algorithm use K mean cluster algorithm by choosing data packet
Size (64,128,256,512,1024,2000) is algorithm initial value, for cluster gained cluster C={ C1, C2, C3, C4, C5,
C6, it selects in every wheel iterative process and minimizes square error:Wherein
It is cluster CiMean vector.Data packet is divided into substantially 6 classes according to initial value size after iteration, and by five yuan of every one kind
Group feature (source IP address, source port, purpose IP address, destination port, application layer protocol) is stored in respective database table
In, so as to module B use.
The function of module B is to carry out protocol validation, agreement cutting, protocol domain using the DPI software of existing comparative maturity
The various means such as cutting extract feature and construct classifier training module.
The function of module C is to carry out flow using the Semi-supervised sorting algorithm (NB Algorithm) in machine learning
Classification is assumed to carry out the data packet in the classifier training module formed after feature extraction by DPI software engine in module B
Label are as follows: CL={ y1, y2, y3..., yn, assume when controller receives a new data packet are as follows: x={ a1, a2, a3,
...am, wherein each a is an attribute of x.After the extraction for carrying out classifier training modular character by DPI, we can be with
That obtain is CL, by calculating P (y1| x), P (y2| x), P (y3| x) ..., P (yn| x), and find out maximum in all probability
That, i.e., if: P (yk| x)=max { P (y1| x), P (y2| x), P (y3| x) ..., P (yn| x) }, then it is considered that this
The data packet just received is x ∈ yk, and the feature of this data packet is added in feature tranining database, as new instruction
Practice database.
Advantages of the present invention:
1. the present invention is by combining unsupervised formula clustering algorithm in DPI technology and machine learning algorithm and semi-supervised
The advantages of formula sorting algorithm, is deployed in different modules using respective feature, and the task of traffic classification is completed in common cooperation,
It can guarantee accuracy rate again and can be avoided the computing resource for consuming controller excessively.
2. the present invention utilizes parallel modules thought and api interface technology, addition is complete from module is set in existing SDN controller
It works at traffic classification, avoid the waste of hardware resource and ensure that flexibility and the graftibility of traffic classification module.
3. according to the extensive work done early period and being read present invention uses more optimized Semi-supervised sorting algorithm
Lot of documents learn the nicety of grading highest of NB Algorithm, and the present invention proposes the instruction in NB Algorithm
The database update technology for practicing library module, ensure that the rich of training dataset feature, to guarantee nicety of grading.
Detailed description of the invention
In order to illustrate more clearly of technical solution of the present invention, attached drawing needed in summary of the invention will be made below
Briefly introduce.
Fig. 1 is the structure system figure of SDN network.
Fig. 2 is a kind of SDN carried out in the SDN controller of traffic classification based on DPI and machine learning algorithm of the invention
The frame construction drawing of controller.
Fig. 3 is a kind of module carried out in the SDN controller of traffic classification based on DPI and machine learning algorithm of the invention
The implementation flow chart for the K mean cluster algorithm that A is used.
Fig. 4 is a kind of module carried out in the SDN controller of traffic classification based on DPI and machine learning algorithm of the invention
DPI technology used in B carries out the implementation flow chart of feature extraction.
Fig. 5 is a kind of module carried out in the SDN controller of traffic classification based on DPI and machine learning algorithm of the invention
The implementation flow chart for NB Algorithm and the tranining database maintenance that C is used.
Specific embodiment
To make the object, technical solutions and advantages of the present invention clearer, below in conjunction with attached drawing to embodiment party of the present invention
Formula is described in further detail.
Shown in Figure 1, the present invention is a kind of SDN controller that traffic classification is carried out based on DPI and machine learning algorithm,
The SDN controller is from module completion traffic classification task is set in the frame of existing controller, and setting module certainly just has parallel place
The ability of reason is the building for being carried out feature database by using Unsupervised clustering algorithm respectively, led to wherein being divided into three submodules again
It crosses and carries out the extraction of feature using DPI technology with composing training database, flow point is carried out by using semisupervised classification algorithm
Class and real-time update tranining database guarantee the precision of classification.
It is shown in Figure 2, it will be broadly divided into traffic flow information feature database building module, feature extraction in the present invention and divide
Class device training module, classifier carry out traffic classification module.
It is shown in Figure 3, cluster behaviour is carried out using K mean cluster algorithm in traffic flow information feature database building module
Make, can be calculated whenever controller is operated by Packet_in from controller existing capability module after interchanger acquisition data packet
The size x of each data packet outi, with the difference of the size of data packet as the Main Analysis element in cluster, first in algorithm
It is 64,128,256,512,1024,2000 as initial mean value vector μ that initial value is selected before starting, and passes through the number for calculating and obtaining
According to the size of packet and the Euclidean distance d of each mean vectori=| | xi-μ||2, choose and wherein determined apart from nearest mean vector
xiCluster label: λj=argminidi, andNew mean vector is calculated according to the cluster newly dividedJudge whether new mean vector and μ are identical, and if they are the same, then μ is remained unchanged and terminated this cluster；If no
Together, then μ is changed to μ and terminates this cluster.In each cluster judgement, mean value is adjusted when understanding the fructufy according to cluster
Vector reaches every data packet in cluster with even more like data package size.
Shown in Figure 4, data packet pcap file can be entered by function call interface after being clustered by modules A
In DPI software analysis engine, data packet is mapped to the data flow by response switch technology by DPI, and selects every stream
In preceding 20 data packets carry out protocol identification and tracking to analyze the type of agreement, here there are three types of may:
1. the first data packet in preceding 20 data packets is it may determine that application type out, at this point, we do to mark
And 19 data packets thereafter are deleted from current analysis engine.
2. the 20th data coating parses corresponding application type, data packet before is saved in always stream packets
In corresponding binary tree, detects the 20th data packet and preceding 19 data packets belong to same stream, therefore this is only marked to flow
?.
It is finished 3. 20 data packets all parse, does not parse corresponding application type, at this moment we are by this stream information
Labeled as data packet set to be tested.It gives module three and carries out exhaustive division.
Last stream information feature can may be stored in corresponding training number with the mapping relations of application type by first two
It is continuously updated according in library, and according to the arrival of stream new every time.Flow table in database saves format are as follows:
| Matching domain | Priority | Counter | Action fields | Cookie | Tag field |
It is shown in Figure 5, classifier modules from test set obtained in module B reading data flow and obtain it is preceding 20
The feature of data packet is one that NB Algorithm seeks corresponding maximum probability to data flow characteristics in training set, by this
Data flow token is the corresponding applicating category of respective streams of maximum probability, and adds the data that this stream feature enters test data flow
In library, until controller stops receiving data flow.
Embodiment 1
One embodiment of the present of invention is given below, illustrates how controller in the present invention completes the classification of a data flow
Process (as shown in figure 3, figure 4 and figure 5), specific data packet dispatching is shown in steps are as follows:
SA01 step: controller is operated by Packet_in from controller existing capability mould after interchanger acquisition data packet
Block can calculate the size x of each data packeti
SA02 step: with the difference of the size of data packet as the Main Analysis element in cluster, start first in algorithm
It is preceding that initial value is selected to be used as initial mean value vector μ for 64,128,256,512,1024,2000.
SA03 step: by calculating the size of the data packet obtained and the Euclidean distance d of each mean vectori=| | xi-μ|
|2, choose and wherein determine x apart from nearest mean vectoriCluster label
SA04 step: new mean vector is calculated according to the cluster newly divided
SA05 step: judging whether new mean vector and μ are identical, and if they are the same, then μ is remained unchanged and terminated this and gathers
Class；If it is different, μ is then changed to μ and terminates this cluster.
SB01 step: it is soft to enter DPI by function call interface for data packet pcap file after being clustered by modules A
In part analysis engine.
SB02 step: data packet is mapped to the data flow by response switch technology by DPI.
SB03 step: preceding 20 data packets in every stream of selection carry out protocol identification and tracking to analyze agreement
Type
SB04 step: current data packet ordinal number≤20 and being detected corresponding applicating category, then stops detecting this stream
And corresponding application label is done as tranining database
SB05 step: if data packet ordinal number is greater than 20 or is not detected corresponding applicating category, this is failed to be sold at auction and is denoted as
To training data stream.
SC01 step: the feature of reading data flow and preceding 20 data packets of acquisition from test set obtained in module B.
SC02 step: being one that NB Algorithm seeks corresponding maximum probability to data flow characteristics in training set, will
This data, which is failed to be sold at auction, is denoted as the corresponding applicating category of respective streams of maximum probability.
SC03 step: it adds this stream feature and enters in the database of test data flow.
SC04 step: judging whether controller stops working, and terminates this subseries if stopping working, if not stopping,
Repeat step SC01.
Claims (6)
1. a kind of SDN controller for carrying out traffic classification based on DPI and machine learning algorithm, is the base in existing SDN controller
From classification of the module completion controller to network flow is set on plinth, feature includes following part:
A, traffic flow information feature database constructs module
B, feature extraction and classifier training module
C, classifier carries out traffic classification module.
2. a kind of SDN controller that traffic classification is carried out based on DPI and machine learning algorithm according to claim 1,
The K mean cluster algorithm being characterized in that in the Unsupervised clustering algorithm used by modules A realizes the cluster for data packet, is formed
Traffic flow information feature database, the feature database that module B is constructed according to modules A carry out the feature extraction based on DPI technology and will be by DPI
The data flow token that technique classification goes out is that training data flow module is stored in tranining database, and module C is according in tranining database
Data flow characteristics and not labeled data flow characteristics do the classification of NB Algorithm, by the unidentified data flow of DPI
Carry out detailed traffic classification.
3. a kind of SDN controller that traffic classification is carried out based on DPI and machine learning algorithm according to claim 2,
Be characterized in that modules A about traffic flow information feature database building module specific step is as follows:
SA01 step: controller is operated by Packet_in can from controller existing capability module after interchanger acquisition data packet
To calculate the size x of each data packeti
SA02 step: it with the difference of the size of data packet as the Main Analysis element in cluster, is selected before algorithm starts first
Selecting initial value is 64,128,256,512,1024,2000 as initial mean value vector μ.
SA03 step: by calculating the size of the data packet obtained and the Euclidean distance d of each mean vectori=| | xi-μ||2, choosing
It takes and wherein determines x apart from nearest mean vectoriCluster label.
SA04 step: new mean vector is calculated according to the cluster newly divided
SA05 step: judge whether new mean vector and μ are identical, and if they are the same, then μ is remained unchanged and terminated this cluster；If
μ is then changed to μ by difference*And terminate this cluster.
4. a kind of SDN controller that traffic classification is carried out based on DPI and machine learning algorithm according to claim 2,
Be characterized in that module B about feature extraction and classifier training module, specific step is as follows:
SB01 step: data packet pcap file can enter DPI software point by function call interface after being clustered by modules A
It analyses in engine.
SB02 step: data packet is mapped to the data flow by response switch technology by DPI.
SB03 step: preceding 20 data packets in every stream of selection carry out protocol identification and tracking to analyze the type of agreement
SB04 step: current data packet ordinal number≤20 and it has been detected corresponding applicating category, then stop detecting this stream and has been done
Corresponding application label is used as tranining database.
SB05 step: if data packet ordinal number is greater than 20 or is not detected corresponding applicating category, this is failed to be sold at auction and is denoted as wait instruct
Practice data flow.
5. a kind of SDN controller that traffic classification is carried out based on DPI and machine learning algorithm according to claim 2,
Be characterized in that module C about classifier carry out traffic classification module specific step is as follows:
SC01 step: the feature of reading data flow and preceding 20 data packets of acquisition from test set obtained in module B.
SC02 step: it is one that NB Algorithm seeks corresponding maximum probability to data flow characteristics in training set, by this
Data flow token is the corresponding applicating category of respective streams of maximum probability.
SC03 step: it adds this stream feature and enters in the database of test data flow.
6. its described in any item a kind of SDN control for carrying out traffic classification based on DPI and machine learning algorithm according to right 1 to 5
Device processed, it is characterised in that the table format of flow table are as follows:
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811574511.9A CN109450740A (en) | 2018-12-21 | 2018-12-21 | SDN controller for carrying out traffic classification based on DPI and machine learning algorithm |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811574511.9A CN109450740A (en) | 2018-12-21 | 2018-12-21 | SDN controller for carrying out traffic classification based on DPI and machine learning algorithm |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN109450740A true CN109450740A (en) | 2019-03-08 |
Family
ID=65537840
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811574511.9A Pending CN109450740A (en) | 2018-12-21 | 2018-12-21 | SDN controller for carrying out traffic classification based on DPI and machine learning algorithm |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109450740A (en) |
Cited By (13)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110213175A (en) * | 2019-06-08 | 2019-09-06 | 西安电子科技大学 | A kind of intelligent managing and control system and management-control method towards knowledge definition network |
| CN110311829A (en) * | 2019-05-24 | 2019-10-08 | 西安电子科技大学 | A kind of net flow assorted method accelerated based on machine learning |
| CN110391958A (en) * | 2019-08-15 | 2019-10-29 | 北京中安智达科技有限公司 | A kind of pair of network encryption flow carries out feature extraction automatically and knows method for distinguishing |
| CN110445800A (en) * | 2019-08-15 | 2019-11-12 | 上海寰创通信科技股份有限公司 | A kind of deep message resolution system based on self study |
| CN111711545A (en) * | 2020-05-29 | 2020-09-25 | 福州大学 | Intelligent encrypted flow identification method based on deep packet inspection technology in software defined network |
| CN111756642A (en) * | 2020-06-02 | 2020-10-09 | 深圳供电局有限公司 | Network traffic scheduling system and method based on DPI and machine learning |
| CN111953641A (en) * | 2019-05-17 | 2020-11-17 | 瞻博网络公司 | Classification of unknown network traffic |
| WO2020228527A1 (en) * | 2019-05-14 | 2020-11-19 | 华为技术有限公司 | Data stream classification method and message forwarding device |
| CN112217834A (en) * | 2020-10-21 | 2021-01-12 | 北京理工大学 | Internet encryption flow interactive feature extraction method based on graph structure |
| CN112637292A (en) * | 2020-12-14 | 2021-04-09 | 中国联合网络通信集团有限公司 | Data processing method and device, electronic equipment and storage medium |
| CN112822121A (en) * | 2019-11-15 | 2021-05-18 | 中兴通讯股份有限公司 | Traffic identification method, traffic determination method and knowledge graph establishment method |
| CN114430419A (en) * | 2021-12-09 | 2022-05-03 | 西安邮电大学 | SDN-based heterogeneous network data stream reconstruction method in intelligent factory |
| WO2023231391A1 (en) * | 2022-05-30 | 2023-12-07 | 天翼云科技有限公司 | Data identification method and apparatus and electronic device |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102394827A (en) * | 2011-11-09 | 2012-03-28 | 浙江万里学院 | Hierarchical classification method for internet flow |
| CN104767692A (en) * | 2015-04-15 | 2015-07-08 | 中国电力科学研究院 | Network traffic classification method |
| CN108446964A (en) * | 2018-03-30 | 2018-08-24 | 中南大学 | A kind of user's recommendation method based on mobile flow DPI data |
-
2018
- 2018-12-21 CN CN201811574511.9A patent/CN109450740A/en active Pending
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102394827A (en) * | 2011-11-09 | 2012-03-28 | 浙江万里学院 | Hierarchical classification method for internet flow |
| CN104767692A (en) * | 2015-04-15 | 2015-07-08 | 中国电力科学研究院 | Network traffic classification method |
| CN108446964A (en) * | 2018-03-30 | 2018-08-24 | 中南大学 | A kind of user's recommendation method based on mobile flow DPI data |
Non-Patent Citations (1)
| Title |
|---|
| 李国平,王勇,陶晓玲: "基于DPI和机器学习的网络流量分类方法", 《桂林电子科技大学学报》 * |
Cited By (24)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US12003609B2 (en) * | 2019-05-14 | 2024-06-04 | Huawei Technologies Co., Ltd. | Data flow classification method and packet forwarding device |
| US20210409334A1 (en) * | 2019-05-14 | 2021-12-30 | Huawei Technologies Co., Ltd. | Data Flow Classification Method and Packet Forwarding Device |
| WO2020228527A1 (en) * | 2019-05-14 | 2020-11-19 | 华为技术有限公司 | Data stream classification method and message forwarding device |
| US11985169B2 (en) | 2019-05-17 | 2024-05-14 | Juniper Networks, Inc. | Classification of unknown network traffic |
| US11323481B2 (en) | 2019-05-17 | 2022-05-03 | Juniper Networks, Inc. | Classification of unknown network traffic |
| CN111953641A (en) * | 2019-05-17 | 2020-11-17 | 瞻博网络公司 | Classification of unknown network traffic |
| CN110311829B (en) * | 2019-05-24 | 2021-03-16 | 西安电子科技大学 | Network traffic classification method based on machine learning acceleration |
| CN110311829A (en) * | 2019-05-24 | 2019-10-08 | 西安电子科技大学 | A kind of net flow assorted method accelerated based on machine learning |
| CN110213175B (en) * | 2019-06-08 | 2022-06-28 | 西安电子科技大学 | Intelligent management and control system and method for knowledge-defined network |
| CN110213175A (en) * | 2019-06-08 | 2019-09-06 | 西安电子科技大学 | A kind of intelligent managing and control system and management-control method towards knowledge definition network |
| CN110445800B (en) * | 2019-08-15 | 2022-06-14 | 上海寰创通信科技股份有限公司 | Self-learning-based deep packet parsing system |
| CN110391958A (en) * | 2019-08-15 | 2019-10-29 | 北京中安智达科技有限公司 | A kind of pair of network encryption flow carries out feature extraction automatically and knows method for distinguishing |
| CN110391958B (en) * | 2019-08-15 | 2021-04-09 | 北京中安智达科技有限公司 | Method for automatically extracting and identifying characteristics of network encrypted flow |
| CN110445800A (en) * | 2019-08-15 | 2019-11-12 | 上海寰创通信科技股份有限公司 | A kind of deep message resolution system based on self study |
| CN112822121A (en) * | 2019-11-15 | 2021-05-18 | 中兴通讯股份有限公司 | Traffic identification method, traffic determination method and knowledge graph establishment method |
| CN111711545A (en) * | 2020-05-29 | 2020-09-25 | 福州大学 | Intelligent encrypted flow identification method based on deep packet inspection technology in software defined network |
| CN111756642A (en) * | 2020-06-02 | 2020-10-09 | 深圳供电局有限公司 | Network traffic scheduling system and method based on DPI and machine learning |
| CN112217834B (en) * | 2020-10-21 | 2021-06-18 | 北京理工大学 | Internet encryption flow interactive feature extraction method based on graph structure |
| CN112217834A (en) * | 2020-10-21 | 2021-01-12 | 北京理工大学 | Internet encryption flow interactive feature extraction method based on graph structure |
| CN112637292B (en) * | 2020-12-14 | 2022-11-22 | 中国联合网络通信集团有限公司 | Data processing method and device, electronic equipment and storage medium |
| CN112637292A (en) * | 2020-12-14 | 2021-04-09 | 中国联合网络通信集团有限公司 | Data processing method and device, electronic equipment and storage medium |
| CN114430419A (en) * | 2021-12-09 | 2022-05-03 | 西安邮电大学 | SDN-based heterogeneous network data stream reconstruction method in intelligent factory |
| CN114430419B (en) * | 2021-12-09 | 2024-01-09 | 西安邮电大学 | Heterogeneous network data stream reconstruction method in intelligent factory based on SDN |
| WO2023231391A1 (en) * | 2022-05-30 | 2023-12-07 | 天翼云科技有限公司 | Data identification method and apparatus and electronic device |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109450740A (en) | SDN controller for carrying out traffic classification based on DPI and machine learning algorithm | |
| CN105827472B (en) | Network data flow type detection method and device | |
| US10187291B2 (en) | Path planning method and controller | |
| CN107704868B (en) | User clustering method based on mobile application use behaviors | |
| WO2015154484A1 (en) | Traffic data classification method and device | |
| CN101605126A (en) | A kind of method and system of multi-protocol data Classification and Identification | |
| US11558769B2 (en) | Estimating apparatus, system, method, and computer-readable medium, and learning apparatus, method, and computer-readable medium | |
| CN110061931B (en) | Industrial control protocol clustering method, device and system and computer storage medium | |
| CN112817755A (en) | Edge cloud cooperative deep learning target detection method based on target tracking acceleration | |
| CN108696453A (en) | The power telecom network SDN Business Streams cognitive method and system of lightweight | |
| CN106911591A (en) | The sorting technique and system of network traffics | |
| CN110225001A (en) | A kind of dynamic self refresh net flow assorted method based on topic model | |
| CN109787823A (en) | Service quality QoS labeling method, device and storage medium | |
| CN100574312C (en) | Analyze the analyzer of packet | |
| Hameed et al. | IoT traffic multi-classification using network and statistical features in a smart environment | |
| Mai et al. | Deep learning to predict the feasibility of priority-based Ethernet network configurations | |
| Zhang et al. | Comparison of Trajectory Clustering Methods based on K-means and DBSCAN | |
| CN104468276B (en) | Network flow identification method based on random sampling multi-categorizer | |
| CN116545944A (en) | Network traffic classification method and system | |
| Gias et al. | Samplehst: Efficient on-the-fly selection of distributed traces | |
| CN114142923A (en) | Optical cable fault positioning method, device, equipment and readable medium | |
| CN113780532B (en) | Training method, device, equipment and storage medium of semantic segmentation network | |
| Deart et al. | Agglomerative Clustering of Network Traffic Based on Various Approaches to Determining the Distance Matrix | |
| CN112003733B (en) | Comprehensive management method and management platform for smart park Internet of things | |
| CN110061869B (en) | Network track classification method and device based on keywords |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| WD01 | Invention patent application deemed withdrawn after publication |
Application publication date: 20190308 |
|
| WD01 | Invention patent application deemed withdrawn after publication |