CN115801604B - Prediction method of network flow characteristic value - Google Patents
Prediction method of network flow characteristic value Download PDFInfo
- Publication number
- CN115801604B CN115801604B CN202310101070.5A CN202310101070A CN115801604B CN 115801604 B CN115801604 B CN 115801604B CN 202310101070 A CN202310101070 A CN 202310101070A CN 115801604 B CN115801604 B CN 115801604B
- Authority
- CN
- China
- Prior art keywords
- time sequence
- network flow
- characteristic value
- model
- value
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 30
- YHXISWVBGDMDLQ-UHFFFAOYSA-N moclobemide Chemical compound C1=CC(Cl)=CC=C1C(=O)NCCN1CCOCC1 YHXISWVBGDMDLQ-UHFFFAOYSA-N 0.000 claims abstract description 28
- 238000001514 detection method Methods 0.000 claims abstract description 3
- 238000004458 analytical method Methods 0.000 claims description 2
- 239000013598 vector Substances 0.000 description 7
- 238000011161 development Methods 0.000 description 3
- 238000012300 Sequence Analysis Methods 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 238000004364 calculation method Methods 0.000 description 1
- 238000009795 derivation Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000005206 flow analysis Methods 0.000 description 1
- 238000012886 linear function Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
- 238000012360 testing method Methods 0.000 description 1
Images
Classifications
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D30/00—Reducing energy consumption in communication networks
- Y02D30/50—Reducing energy consumption in communication networks in wire-line communication networks, e.g. low power modes or reduced link rate
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The invention discloses a prediction method of a network flow characteristic value, which comprises the steps of obtaining a network flow in an Internet of things network; extracting characteristic values in the network flow, and obtaining a time sequence based on the characteristic values; checking the time series; and predicting the time sequence through an ARIMA model or normal distribution based on the detection result to obtain a network flow characteristic value prediction result.
Description
Technical Field
The invention relates to the technical field of equipment identification of the Internet of things, in particular to a prediction method of a network flow characteristic value.
Background
Along with the development of the ecological system of the Internet of things, the equipment of the Internet of things is characterized and fingerprint identification becomes a trend. In the fingerprint identification model, the network flow feature vector is required to be used for judgment, but the feature vector can only be extracted through the complete network flow, and the feature vector of the network flow can not be obtained in real time, so that the Internet of things equipment can not be accurately identified.
In order to ensure accurate identification of the internet of things equipment, how to accurately obtain the feature vector of the network flow, namely the network flow feature value, is a problem to be solved.
Disclosure of Invention
In order to solve the problems in the prior art, the invention provides a method for predicting the characteristic value of a network flow, which can accurately acquire the characteristic vector of the network flow.
In order to achieve the technical purpose, the invention provides the following technical scheme: a method for predicting network flow characteristic values, comprising:
acquiring a network flow in an Internet of things network; extracting the characteristic value of the network flow, and obtaining a time sequence based on the characteristic value;
checking the time sequence to judge whether the time sequence is random enough; and predicting the time sequence through an ARIMA model or normal distribution based on the detection result to obtain a network flow characteristic value prediction result.
Optionally, the network flow in the internet of things network includes fewer data packets than the actual number of data packets in the network flow, that is, the network flow is an incomplete network flow.
Optionally, after checking the randomness of the time sequence, if the time sequence is not sufficiently random, the time sequence is predicted by an ARIMA model, and if the time sequence is sufficiently random, the time sequence is predicted by a normal distribution.
Optionally, the specific process of verifying the time sequence includes:
constructing and initializing a hysteresis value, and carrying out iterative updating on the hysteresis value until the hysteresis value reaches a preset condition, and stopping updating;
based on the hysteresis value after stopping updating, carrying out significance analysis on the time sequence to obtain statistics;
and judging the statistic by a threshold value, wherein when the statistic is smaller than a preset threshold value, the time sequence is sufficiently random, and otherwise, the time sequence is not sufficiently random.
Optionally, the preset conditions are:
wherein,,is a hysteresis value->To round down the function ++>Is the number of network flow packets.
Optionally, the process of predicting the time sequence by the ARIMA model includes:
constructing an ARIMA model, inputting the characteristic time sequence into the ARIMA model for parameter fitting to obtain model parameters, substituting the model parameters into an updated ARIMA model, inputting the characteristic value sequence t into the updated ARIMA model to obtain a predicted characteristic valueNamely, the prediction result of the network flow characteristic value:
wherein,,for the order of the autoregressive model,Dfor difference degree (I)>Order of moving average model, +.>For fixing hysteresis operator, ++>For the ith hysteresis operator, +.>Is a parameter of the autoregressive model, +.>For parameters of the moving average model, +.>Is an error term->Is a constant term.
Optionally, the process of predicting the time series by normal distribution includes: calculating the mean of eigenvalues in a time seriesThe method comprises the steps of carrying out a first treatment on the surface of the Calculating variance of eigenvalues in time series +.>The method comprises the steps of carrying out a first treatment on the surface of the Based on the mean and variance, obtaining a predicted characteristic valueNamely, the prediction result of the network flow characteristic value: />
The invention has the following technical effects:
the invention judges whether the network flow is sufficiently random or not by carrying out time sequence analysis on the network flow in transmission, and if the network flow is insufficiently random, the network flow is predicted by using an ARIMA model; if the network flow is sufficiently random, the normal distribution is used for predicting the network flow, so that the feature vector of the network flow can be accurately and effectively predicted, and other works can be better carried out.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions of the prior art, the drawings that are needed in the embodiments will be briefly described below, it being obvious that the drawings in the following description are only some embodiments of the present invention, and that other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
Fig. 1 is a schematic flow chart of a method according to an embodiment of the present invention.
Detailed Description
The following description of the embodiments of the present invention will be made clearly and completely with reference to the accompanying drawings, in which it is apparent that the embodiments described are only some embodiments of the present invention, but not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
According to the invention, the network flow characteristic value and the time sequence thereof are extracted by capturing the network flow transmitted in the network of the Internet of things, the prediction method is selected according to the randomness degree of the characteristic value time sequence, the ARIMA model is selected if the characteristic value time sequence is insufficiently random, and the normal distribution is selected if the characteristic value is sufficiently random, so that the predicted network flow characteristic value is obtained for the development of the next work.
The whole flow steps are as follows: s1, capturing a network flow to obtain an incomplete network flow; s2, extracting characteristic values and time sequences thereof; s3, judging whether the time sequence is sufficiently random; s4, insufficiently and randomly, and predicting by using an ARIMA model; s5, fully and randomly, and predicting by using normal distribution.
The method comprises the following specific steps:
s1, capturing a certain network flow transmitted in an Internet of things network, wherein the captured network flow is recorded asIs->A data packet, wherein->For the actual number of packets of the stream, co-capture +.>Bag(s) or(s) of (are)>Is the difference between the actual number of packets and the number of packets captured, i.e. an incomplete network flow is captured
S2 extracting characteristic values and time sequence thereof
S21 extracting captured network flowsFeature vectors, i.e. feature values, of the individual packets and stored inIn the following expression:
wherein,,the number of the characteristic values is determined by the selected characteristic values; />Co-extracting +.>Secondary times
S22, calculating a time sequence of the corresponding characteristic value according to the extracted characteristic value, and marking as
Description: taking the average time of arrival of a packet as an example,and the like, a time sequence of the characteristic values can be obtained.
S3, detecting whether the time sequence of the characteristic value is sufficiently random, and checking the randomness of the time sequence by using Ljung-Box;
Wherein whenTime series->Not sufficiently random, prediction is performed using an ARIMA model; when->Time series->Is sufficiently random to predict using normal distribution
s321 calculating the assumed valueThe calculation formula is as follows, and is used for judging whether the time sequence is sufficiently random or not: />
Wherein,,is the size of the time series of stream characteristics values, < >>Is a hysteresis ofkAutocorrelation at the site,/->Is the hysteresis value under test.
description: the empirical value can be set by oneself, the invention is set to 0.05
when (when)Time series->Not sufficiently random, future feature values are predicted using ARIMA model, when +.>Time series->Is sufficiently random to predict future feature values using a normal distribution.
S4 ifTime ofSequence->Not sufficiently random, predicting future feature values using an ARIMA model;
s41, establishing an ARIMA model, and predicting characteristic valuesThe formula of (2) is as follows:
wherein,,for the order of the autoregressive model,Dfor difference degree (I)>Order of moving average model, +.>For the ith hysteresis operator, +.>For fixing hysteresis operator, ++>Is the i-th parameter of the autoregressive model, < - > and->For the ith parameter of the moving average model, +.>Is an error term->Is a constant term->Wherein the method comprises the steps ofNThe number of parameters for the autoregressive model/moving average model.
Description:autoregressive model: a method of processing a time series using the same variable, e.gBefore (i.e.)>To->To predict the present period +.>And assuming that they are in a linear relationship;
moving average model: model formed by linear function of random error term and lag error term of time sequence current value
S42 time-series the characteristic valuesInputting into ARIMA model, performing parameter fitting to obtain the order of autoregressive model +.>Differential degree->Order of moving average model +.>
S43 feature value sequence number to be predictedInputting into ARIMA model to obtain predicted characteristic value +.>The formula is as follows>
S5 ifNot equal to->Description time series->Is sufficiently random to predict future feature values using normal distribution
s53, randomly extracting random samples from Gaussian distribution to generate a sample meeting the requirementIs used as the future characteristic value +.>
The invention selects the prediction method according to the randomness degree of the characteristic value time sequence by extracting the characteristic value and the characteristic value time sequence of the network flow which is being transmitted, and selects the ARIMA model if the characteristic value time sequence is insufficiently random, and selects the normal distribution if the characteristic value time sequence is sufficiently random, thereby obtaining the predicted characteristic value for carrying out the development of the next work, and providing assistance for the works such as the network flow length prediction, the network flow deformation and the like.
In current network flow analysis methods, a great deal of attention is paid to the non-payload characteristics of the network flow, i.e. to the derivation of data other than that which needs to be transmitted. Such derived feature values may be referred to as raw features, such as average, maximum, minimum and standard deviation of the inter-arrival times of the PDUs, derived from the inter-arrival time sequence between the packets.
The invention judges whether the characteristic value time sequence is sufficiently random or not by extracting the characteristic value and the characteristic value time sequence of the network flow which is being transmitted, and predicts the characteristic value time sequence by using an ARIMA model if the characteristic value time sequence is insufficiently random; if the network flow length prediction method is sufficiently random, normal distribution is used for predicting the network flow length prediction method, so that the next work is better carried out, and the network flow deformation method is helpful for works such as network flow length prediction, network flow deformation and the like.
The foregoing has shown and described the basic principles, principal features and advantages of the invention. It will be understood by those skilled in the art that the present invention is not limited to the embodiments described above, and that the above embodiments and descriptions are merely illustrative of the principles of the present invention, and various changes and modifications may be made without departing from the spirit and scope of the invention, which is defined in the appended claims. The scope of the invention is defined by the appended claims and equivalents thereof.
Claims (4)
1. A method for predicting a network flow characteristic value, comprising:
acquiring a network flow in an Internet of things network; extracting the characteristic value of the network flow, and obtaining a time sequence based on the characteristic value;
checking the time sequence to judge whether the time sequence is random enough; based on the detection result, predicting the time sequence through an ARIMA model or normal distribution to obtain a network flow characteristic value prediction result;
after the randomness of the time sequence is checked, the time sequence is not sufficiently random, the time sequence is predicted through an ARIMA model, and if the time sequence is sufficiently random, the time sequence is predicted through normal distribution;
the process of predicting a time sequence by the ARIMA model includes:
constructing an ARIMA model, inputting the time sequence into the ARIMA model for parameter fitting to obtain model parameters, substituting the model parameters into an updated ARIMA model, inputting the characteristic value sequence t into the updated ARIMA model to obtain a predicted characteristic valueNamely, the prediction result of the network flow characteristic value:
wherein (1)>For the order of the autoregressive model,Dfor difference degree (I)>Order of moving average model, +.>For fixing hysteresis operator, ++>For the ith hysteresis operator, +.>Is a parameter of the autoregressive model, +.>For parameters of the moving average model, +.>Is an error term->Is a constant term;
the process of predicting a time series by normal distribution includes:
Based on the mean and variance, obtaining a predicted characteristic valueNamely, the prediction result of the network flow characteristic value:
2. The prediction method according to claim 1, characterized in that:
the network flow in the internet of things comprises data packets with the number smaller than the actual data packets of the network flow, namely the network flow is an incomplete network flow.
3. The prediction method according to claim 1, characterized in that:
the specific process for checking the time sequence comprises the following steps:
constructing and initializing a hysteresis value, and carrying out iterative updating on the hysteresis value until the hysteresis value reaches a preset condition, and stopping updating;
based on the hysteresis value after stopping updating, carrying out significance analysis on the time sequence to obtain statistics;
and judging the statistic by a threshold value, wherein when the statistic is smaller than a preset threshold value, the time sequence is sufficiently random, and otherwise, the time sequence is not sufficiently random.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202310101070.5A CN115801604B (en) | 2023-02-13 | 2023-02-13 | Prediction method of network flow characteristic value |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202310101070.5A CN115801604B (en) | 2023-02-13 | 2023-02-13 | Prediction method of network flow characteristic value |
Publications (2)
Publication Number | Publication Date |
---|---|
CN115801604A CN115801604A (en) | 2023-03-14 |
CN115801604B true CN115801604B (en) | 2023-05-02 |
Family
ID=85430836
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN202310101070.5A Active CN115801604B (en) | 2023-02-13 | 2023-02-13 | Prediction method of network flow characteristic value |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN115801604B (en) |
Citations (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN112929214A (en) * | 2021-02-02 | 2021-06-08 | 北京明朝万达科技股份有限公司 | Model construction method, device, equipment and storage medium |
Family Cites Families (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6928398B1 (en) * | 2000-11-09 | 2005-08-09 | Spss, Inc. | System and method for building a time series model |
CN106990763B (en) * | 2017-04-20 | 2017-12-29 | 浙江大学 | A kind of Vertical Mill operation regulator control system and method based on data mining |
CN109951358A (en) * | 2019-03-21 | 2019-06-28 | 北京交通大学 | Data network method for predicting |
CN111882135B (en) * | 2020-08-05 | 2024-04-30 | 杭州安恒信息技术股份有限公司 | Internet of things equipment intrusion detection method and related device |
CN115695046B (en) * | 2022-12-28 | 2023-03-31 | 广东工业大学 | Network intrusion detection method based on reinforcement ensemble learning |
-
2023
- 2023-02-13 CN CN202310101070.5A patent/CN115801604B/en active Active
Patent Citations (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN112929214A (en) * | 2021-02-02 | 2021-06-08 | 北京明朝万达科技股份有限公司 | Model construction method, device, equipment and storage medium |
Also Published As
Publication number | Publication date |
---|---|
CN115801604A (en) | 2023-03-14 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
CN105425779B (en) | ICA-PCA multi-state method for diagnosing faults based on local neighborhood standardization and Bayesian inference | |
CN105184325B (en) | Mobile intelligent terminal | |
CN116930042B (en) | Building waterproof material performance detection equipment and method | |
CN117784710B (en) | Remote state monitoring system and method for numerical control machine tool | |
CN114218998A (en) | Power system abnormal behavior analysis method based on hidden Markov model | |
CN117041017A (en) | Intelligent operation and maintenance management method and system for data center | |
CN111814776A (en) | Image processing method, device, server and storage medium | |
CN117592870B (en) | Comprehensive analysis system based on water environment monitoring information | |
CN115801604B (en) | Prediction method of network flow characteristic value | |
CN117849193A (en) | Online crack damage monitoring method for neodymium iron boron sintering | |
CN117562311A (en) | Detection system of high-performance electronic cigarette atomizer | |
WO2024103470A1 (en) | Performance testing system and method for escalator production | |
CN117171619A (en) | Intelligent power grid terminal network anomaly detection model and method | |
CN114005183B (en) | Action recognition method, device, equipment and storage medium | |
CN113610167B (en) | Equipment risk detection method based on metric learning and visual perception | |
EP4156115A1 (en) | Method and apparatus for identifying product that has missed inspection, electronic device, and storage medium | |
WO2023273570A1 (en) | Target detection model training method and target detection method, and related device therefor | |
CN115147349A (en) | Method and device for determining smelting end point of converter, electronic equipment and storage medium | |
CN112954689A (en) | Lightweight network intrusion detection system and method for Bluetooth wireless transmission | |
CN114374561B (en) | Network security state evaluation method, device and storable medium | |
CN112287387B (en) | Privacy protection statistical analysis method and system, server side and equipment terminal | |
CN116630909B (en) | Unmanned intelligent monitoring system and method based on unmanned aerial vehicle | |
CN117877100B (en) | Behavior mode determining method and device, electronic equipment and storage medium | |
CN117332352B (en) | Lightning arrester signal defect identification method based on BAM-AlexNet | |
CN118413405A (en) | Industrial control auditing method and device based on industrial Internet |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PB01 | Publication | ||
PB01 | Publication | ||
SE01 | Entry into force of request for substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
GR01 | Patent grant | ||
GR01 | Patent grant |