CN115801604B - Prediction method of network flow characteristic value - Google Patents

Prediction method of network flow characteristic value Download PDF

Info

Publication number
CN115801604B
CN115801604B CN202310101070.5A CN202310101070A CN115801604B CN 115801604 B CN115801604 B CN 115801604B CN 202310101070 A CN202310101070 A CN 202310101070A CN 115801604 B CN115801604 B CN 115801604B
Authority
CN
China
Prior art keywords
time sequence
network flow
characteristic value
model
value
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202310101070.5A
Other languages
Chinese (zh)
Other versions
CN115801604A (en
Inventor
姜达成
谭帅帅
刘文印
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Guangdong University of Technology
Original Assignee
Guangdong University of Technology
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Guangdong University of Technology filed Critical Guangdong University of Technology
Priority to CN202310101070.5A priority Critical patent/CN115801604B/en
Publication of CN115801604A publication Critical patent/CN115801604A/en
Application granted granted Critical
Publication of CN115801604B publication Critical patent/CN115801604B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D30/00—Reducing energy consumption in communication networks
    • Y02D30/50—Reducing energy consumption in communication networks in wire-line communication networks, e.g. low power modes or reduced link rate

Landscapes

  • Data Exchanges In Wide-Area Networks (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

The invention discloses a prediction method of a network flow characteristic value, which comprises the steps of obtaining a network flow in an Internet of things network; extracting characteristic values in the network flow, and obtaining a time sequence based on the characteristic values; checking the time series; and predicting the time sequence through an ARIMA model or normal distribution based on the detection result to obtain a network flow characteristic value prediction result.

Description

Prediction method of network flow characteristic value
Technical Field
The invention relates to the technical field of equipment identification of the Internet of things, in particular to a prediction method of a network flow characteristic value.
Background
Along with the development of the ecological system of the Internet of things, the equipment of the Internet of things is characterized and fingerprint identification becomes a trend. In the fingerprint identification model, the network flow feature vector is required to be used for judgment, but the feature vector can only be extracted through the complete network flow, and the feature vector of the network flow can not be obtained in real time, so that the Internet of things equipment can not be accurately identified.
In order to ensure accurate identification of the internet of things equipment, how to accurately obtain the feature vector of the network flow, namely the network flow feature value, is a problem to be solved.
Disclosure of Invention
In order to solve the problems in the prior art, the invention provides a method for predicting the characteristic value of a network flow, which can accurately acquire the characteristic vector of the network flow.
In order to achieve the technical purpose, the invention provides the following technical scheme: a method for predicting network flow characteristic values, comprising:
acquiring a network flow in an Internet of things network; extracting the characteristic value of the network flow, and obtaining a time sequence based on the characteristic value;
checking the time sequence to judge whether the time sequence is random enough; and predicting the time sequence through an ARIMA model or normal distribution based on the detection result to obtain a network flow characteristic value prediction result.
Optionally, the network flow in the internet of things network includes fewer data packets than the actual number of data packets in the network flow, that is, the network flow is an incomplete network flow.
Optionally, after checking the randomness of the time sequence, if the time sequence is not sufficiently random, the time sequence is predicted by an ARIMA model, and if the time sequence is sufficiently random, the time sequence is predicted by a normal distribution.
Optionally, the specific process of verifying the time sequence includes:
constructing and initializing a hysteresis value, and carrying out iterative updating on the hysteresis value until the hysteresis value reaches a preset condition, and stopping updating;
based on the hysteresis value after stopping updating, carrying out significance analysis on the time sequence to obtain statistics;
and judging the statistic by a threshold value, wherein when the statistic is smaller than a preset threshold value, the time sequence is sufficiently random, and otherwise, the time sequence is not sufficiently random.
Optionally, the preset conditions are:
Figure SMS_1
wherein,,
Figure SMS_2
is a hysteresis value->
Figure SMS_3
To round down the function ++>
Figure SMS_4
Is the number of network flow packets.
Optionally, the process of predicting the time sequence by the ARIMA model includes:
constructing an ARIMA model, inputting the characteristic time sequence into the ARIMA model for parameter fitting to obtain model parameters, substituting the model parameters into an updated ARIMA model, inputting the characteristic value sequence t into the updated ARIMA model to obtain a predicted characteristic value
Figure SMS_5
Namely, the prediction result of the network flow characteristic value:
Figure SMS_6
wherein ARIMA model
Figure SMS_7
The method comprises the following steps:
Figure SMS_8
wherein,,
Figure SMS_10
for the order of the autoregressive model,Dfor difference degree (I)>
Figure SMS_12
Order of moving average model, +.>
Figure SMS_14
For fixing hysteresis operator, ++>
Figure SMS_11
For the ith hysteresis operator, +.>
Figure SMS_13
Is a parameter of the autoregressive model, +.>
Figure SMS_15
For parameters of the moving average model, +.>
Figure SMS_16
Is an error term->
Figure SMS_9
Is a constant term.
Optionally, the process of predicting the time series by normal distribution includes: calculating the mean of eigenvalues in a time series
Figure SMS_17
The method comprises the steps of carrying out a first treatment on the surface of the Calculating variance of eigenvalues in time series +.>
Figure SMS_18
The method comprises the steps of carrying out a first treatment on the surface of the Based on the mean and variance, obtaining a predicted characteristic value
Figure SMS_19
Namely, the prediction result of the network flow characteristic value: />
Figure SMS_20
Wherein,,
Figure SMS_21
to return a random sample drawn from a normal distribution of given mean, variance.
The invention has the following technical effects:
the invention judges whether the network flow is sufficiently random or not by carrying out time sequence analysis on the network flow in transmission, and if the network flow is insufficiently random, the network flow is predicted by using an ARIMA model; if the network flow is sufficiently random, the normal distribution is used for predicting the network flow, so that the feature vector of the network flow can be accurately and effectively predicted, and other works can be better carried out.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions of the prior art, the drawings that are needed in the embodiments will be briefly described below, it being obvious that the drawings in the following description are only some embodiments of the present invention, and that other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
Fig. 1 is a schematic flow chart of a method according to an embodiment of the present invention.
Detailed Description
The following description of the embodiments of the present invention will be made clearly and completely with reference to the accompanying drawings, in which it is apparent that the embodiments described are only some embodiments of the present invention, but not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
According to the invention, the network flow characteristic value and the time sequence thereof are extracted by capturing the network flow transmitted in the network of the Internet of things, the prediction method is selected according to the randomness degree of the characteristic value time sequence, the ARIMA model is selected if the characteristic value time sequence is insufficiently random, and the normal distribution is selected if the characteristic value is sufficiently random, so that the predicted network flow characteristic value is obtained for the development of the next work.
The whole flow steps are as follows: s1, capturing a network flow to obtain an incomplete network flow; s2, extracting characteristic values and time sequences thereof; s3, judging whether the time sequence is sufficiently random; s4, insufficiently and randomly, and predicting by using an ARIMA model; s5, fully and randomly, and predicting by using normal distribution.
The method comprises the following specific steps:
s1, capturing a certain network flow transmitted in an Internet of things network, wherein the captured network flow is recorded as
Figure SMS_22
Is->
Figure SMS_23
A data packet, wherein->
Figure SMS_24
For the actual number of packets of the stream, co-capture +.>
Figure SMS_25
Bag(s) or(s) of (are)>
Figure SMS_26
Is the difference between the actual number of packets and the number of packets captured, i.e. an incomplete network flow is captured
S2 extracting characteristic values and time sequence thereof
S21 extracting captured network flows
Figure SMS_27
Feature vectors, i.e. feature values, of the individual packets and stored in
Figure SMS_28
In the following expression:
Figure SMS_29
wherein,,
Figure SMS_30
the number of the characteristic values is determined by the selected characteristic values; />
Figure SMS_31
Co-extracting +.>
Figure SMS_32
Secondary times
S22, calculating a time sequence of the corresponding characteristic value according to the extracted characteristic value, and marking as
Figure SMS_33
Description: taking the average time of arrival of a packet as an example,
Figure SMS_34
and the like, a time sequence of the characteristic values can be obtained.
S3, detecting whether the time sequence of the characteristic value is sufficiently random, and checking the randomness of the time sequence by using Ljung-Box;
s31 initializing random tag variables
Figure SMS_35
Wherein when
Figure SMS_36
Time series->
Figure SMS_37
Not sufficiently random, prediction is performed using an ARIMA model; when->
Figure SMS_38
Time series->
Figure SMS_39
Is sufficiently random to predict using normal distribution
S32, traversing from
Figure SMS_40
Starting with a step size of 1 until
Figure SMS_41
Stopping;
wherein,,
Figure SMS_42
to calculate the parameter->
Figure SMS_43
Minimum value of->
Figure SMS_44
Is a downward rounding function;
s321 calculating the assumed value
Figure SMS_45
The calculation formula is as follows, and is used for judging whether the time sequence is sufficiently random or not: />
Figure SMS_46
Wherein,,
Figure SMS_47
is the size of the time series of stream characteristics values, < >>
Figure SMS_48
Is a hysteresis ofkAutocorrelation at the site,/->
Figure SMS_49
Is the hysteresis value under test.
S33 assuming a value
Figure SMS_50
Comparison with an empirical value of 0.05:
description: the empirical value can be set by oneself, the invention is set to 0.05
S331 if
Figure SMS_51
Let->
Figure SMS_52
S332 if
Figure SMS_53
Is not operated
S34 will
Figure SMS_54
And->
Figure SMS_55
Comparison is performed:
when (when)
Figure SMS_56
Time series->
Figure SMS_57
Not sufficiently random, future feature values are predicted using ARIMA model, when +.>
Figure SMS_58
Time series->
Figure SMS_59
Is sufficiently random to predict future feature values using a normal distribution.
S4 if
Figure SMS_60
Time ofSequence->
Figure SMS_61
Not sufficiently random, predicting future feature values using an ARIMA model;
s41, establishing an ARIMA model, and predicting characteristic values
Figure SMS_62
The formula of (2) is as follows:
Figure SMS_63
wherein,,
Figure SMS_65
for the order of the autoregressive model,Dfor difference degree (I)>
Figure SMS_68
Order of moving average model, +.>
Figure SMS_70
For the ith hysteresis operator, +.>
Figure SMS_66
For fixing hysteresis operator, ++>
Figure SMS_69
Is the i-th parameter of the autoregressive model, < - > and->
Figure SMS_71
For the ith parameter of the moving average model, +.>
Figure SMS_72
Is an error term->
Figure SMS_64
Is a constant term->
Figure SMS_67
Wherein the method comprises the steps ofNThe number of parameters for the autoregressive model/moving average model.
Description:autoregressive model: a method of processing a time series using the same variable, e.g
Figure SMS_73
Before (i.e.)>
Figure SMS_74
To->
Figure SMS_75
To predict the present period +.>
Figure SMS_76
And assuming that they are in a linear relationship;
moving average model: model formed by linear function of random error term and lag error term of time sequence current value
S42 time-series the characteristic values
Figure SMS_77
Inputting into ARIMA model, performing parameter fitting to obtain the order of autoregressive model +.>
Figure SMS_78
Differential degree->
Figure SMS_79
Order of moving average model +.>
Figure SMS_80
S43 feature value sequence number to be predicted
Figure SMS_81
Inputting into ARIMA model to obtain predicted characteristic value +.>
Figure SMS_82
The formula is as follows>
Figure SMS_83
S5 if
Figure SMS_84
Not equal to->
Figure SMS_85
Description time series->
Figure SMS_86
Is sufficiently random to predict future feature values using normal distribution
S51 calculating the mean value of the characteristic values
Figure SMS_87
The formula is as follows:
Figure SMS_88
s52 calculating eigenvalue variance
Figure SMS_89
The formula is as follows:
Figure SMS_90
s53, randomly extracting random samples from Gaussian distribution to generate a sample meeting the requirement
Figure SMS_91
Is used as the future characteristic value +.>
Figure SMS_92
Figure SMS_93
Wherein,,
Figure SMS_94
to return a random sample drawn from a normal distribution of given mean, variance.
The invention selects the prediction method according to the randomness degree of the characteristic value time sequence by extracting the characteristic value and the characteristic value time sequence of the network flow which is being transmitted, and selects the ARIMA model if the characteristic value time sequence is insufficiently random, and selects the normal distribution if the characteristic value time sequence is sufficiently random, thereby obtaining the predicted characteristic value for carrying out the development of the next work, and providing assistance for the works such as the network flow length prediction, the network flow deformation and the like.
In current network flow analysis methods, a great deal of attention is paid to the non-payload characteristics of the network flow, i.e. to the derivation of data other than that which needs to be transmitted. Such derived feature values may be referred to as raw features, such as average, maximum, minimum and standard deviation of the inter-arrival times of the PDUs, derived from the inter-arrival time sequence between the packets.
The invention judges whether the characteristic value time sequence is sufficiently random or not by extracting the characteristic value and the characteristic value time sequence of the network flow which is being transmitted, and predicts the characteristic value time sequence by using an ARIMA model if the characteristic value time sequence is insufficiently random; if the network flow length prediction method is sufficiently random, normal distribution is used for predicting the network flow length prediction method, so that the next work is better carried out, and the network flow deformation method is helpful for works such as network flow length prediction, network flow deformation and the like.
The foregoing has shown and described the basic principles, principal features and advantages of the invention. It will be understood by those skilled in the art that the present invention is not limited to the embodiments described above, and that the above embodiments and descriptions are merely illustrative of the principles of the present invention, and various changes and modifications may be made without departing from the spirit and scope of the invention, which is defined in the appended claims. The scope of the invention is defined by the appended claims and equivalents thereof.

Claims (4)

1. A method for predicting a network flow characteristic value, comprising:
acquiring a network flow in an Internet of things network; extracting the characteristic value of the network flow, and obtaining a time sequence based on the characteristic value;
checking the time sequence to judge whether the time sequence is random enough; based on the detection result, predicting the time sequence through an ARIMA model or normal distribution to obtain a network flow characteristic value prediction result;
after the randomness of the time sequence is checked, the time sequence is not sufficiently random, the time sequence is predicted through an ARIMA model, and if the time sequence is sufficiently random, the time sequence is predicted through normal distribution;
the process of predicting a time sequence by the ARIMA model includes:
constructing an ARIMA model, inputting the time sequence into the ARIMA model for parameter fitting to obtain model parameters, substituting the model parameters into an updated ARIMA model, inputting the characteristic value sequence t into the updated ARIMA model to obtain a predicted characteristic value
Figure QLYQS_1
Namely, the prediction result of the network flow characteristic value:
Figure QLYQS_2
wherein ARIMA model->
Figure QLYQS_3
The method comprises the following steps:
Figure QLYQS_5
wherein (1)>
Figure QLYQS_8
For the order of the autoregressive model,Dfor difference degree (I)>
Figure QLYQS_10
Order of moving average model, +.>
Figure QLYQS_6
For fixing hysteresis operator, ++>
Figure QLYQS_9
For the ith hysteresis operator, +.>
Figure QLYQS_11
Is a parameter of the autoregressive model, +.>
Figure QLYQS_12
For parameters of the moving average model, +.>
Figure QLYQS_4
Is an error term->
Figure QLYQS_7
Is a constant term;
the process of predicting a time series by normal distribution includes:
calculating the mean of eigenvalues in a time series
Figure QLYQS_13
；
Calculating variance of eigenvalues in time series
Figure QLYQS_14
；
Based on the mean and variance, obtaining a predicted characteristic value
Figure QLYQS_15
Namely, the prediction result of the network flow characteristic value:
Figure QLYQS_16
wherein (1)>
Figure QLYQS_17
To return a random sample drawn from a normal distribution of given mean, variance.
2. The prediction method according to claim 1, characterized in that:
the network flow in the internet of things comprises data packets with the number smaller than the actual data packets of the network flow, namely the network flow is an incomplete network flow.
3. The prediction method according to claim 1, characterized in that:
the specific process for checking the time sequence comprises the following steps:
constructing and initializing a hysteresis value, and carrying out iterative updating on the hysteresis value until the hysteresis value reaches a preset condition, and stopping updating;
based on the hysteresis value after stopping updating, carrying out significance analysis on the time sequence to obtain statistics;
and judging the statistic by a threshold value, wherein when the statistic is smaller than a preset threshold value, the time sequence is sufficiently random, and otherwise, the time sequence is not sufficiently random.
4. A prediction method according to claim 3, characterized in that:
the preset conditions are as follows:
Figure QLYQS_18
wherein (1)>
Figure QLYQS_19
Is a hysteresis value->
Figure QLYQS_20
To round down the function ++>
Figure QLYQS_21
Is the number of network flow packets. />
CN202310101070.5A 2023-02-13 2023-02-13 Prediction method of network flow characteristic value Active CN115801604B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202310101070.5A CN115801604B (en) 2023-02-13 2023-02-13 Prediction method of network flow characteristic value

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202310101070.5A CN115801604B (en) 2023-02-13 2023-02-13 Prediction method of network flow characteristic value

Publications (2)

Publication Number Publication Date
CN115801604A CN115801604A (en) 2023-03-14
CN115801604B true CN115801604B (en) 2023-05-02

Family

ID=85430836

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202310101070.5A Active CN115801604B (en) 2023-02-13 2023-02-13 Prediction method of network flow characteristic value

Country Status (1)

Country Link
CN (1) CN115801604B (en)

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112929214A (en) * 2021-02-02 2021-06-08 北京明朝万达科技股份有限公司 Model construction method, device, equipment and storage medium

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6928398B1 (en) * 2000-11-09 2005-08-09 Spss, Inc. System and method for building a time series model
CN106990763B (en) * 2017-04-20 2017-12-29 浙江大学 A kind of Vertical Mill operation regulator control system and method based on data mining
CN109951358A (en) * 2019-03-21 2019-06-28 北京交通大学 Data network method for predicting
CN111882135B (en) * 2020-08-05 2024-04-30 杭州安恒信息技术股份有限公司 Internet of things equipment intrusion detection method and related device
CN115695046B (en) * 2022-12-28 2023-03-31 广东工业大学 Network intrusion detection method based on reinforcement ensemble learning

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112929214A (en) * 2021-02-02 2021-06-08 北京明朝万达科技股份有限公司 Model construction method, device, equipment and storage medium

Also Published As

Publication number Publication date
CN115801604A (en) 2023-03-14

Similar Documents

Publication Publication Date Title
CN105425779B (en) ICA-PCA multi-state method for diagnosing faults based on local neighborhood standardization and Bayesian inference
CN105184325B (en) Mobile intelligent terminal
CN116930042B (en) Building waterproof material performance detection equipment and method
CN117784710B (en) Remote state monitoring system and method for numerical control machine tool
CN114218998A (en) Power system abnormal behavior analysis method based on hidden Markov model
CN117041017A (en) Intelligent operation and maintenance management method and system for data center
CN111814776A (en) Image processing method, device, server and storage medium
CN117592870B (en) Comprehensive analysis system based on water environment monitoring information
CN115801604B (en) Prediction method of network flow characteristic value
CN117849193A (en) Online crack damage monitoring method for neodymium iron boron sintering
CN117562311A (en) Detection system of high-performance electronic cigarette atomizer
WO2024103470A1 (en) Performance testing system and method for escalator production
CN117171619A (en) Intelligent power grid terminal network anomaly detection model and method
CN114005183B (en) Action recognition method, device, equipment and storage medium
CN113610167B (en) Equipment risk detection method based on metric learning and visual perception
EP4156115A1 (en) Method and apparatus for identifying product that has missed inspection, electronic device, and storage medium
WO2023273570A1 (en) Target detection model training method and target detection method, and related device therefor
CN115147349A (en) Method and device for determining smelting end point of converter, electronic equipment and storage medium
CN112954689A (en) Lightweight network intrusion detection system and method for Bluetooth wireless transmission
CN114374561B (en) Network security state evaluation method, device and storable medium
CN112287387B (en) Privacy protection statistical analysis method and system, server side and equipment terminal
CN116630909B (en) Unmanned intelligent monitoring system and method based on unmanned aerial vehicle
CN117877100B (en) Behavior mode determining method and device, electronic equipment and storage medium
CN117332352B (en) Lightning arrester signal defect identification method based on BAM-AlexNet
CN118413405A (en) Industrial control auditing method and device based on industrial Internet

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant