Classification Of Network Traffic Based On Netfpga

High-performance network flow classification is the foundation of many cyber securities. The Research of flow classification has both real-life value and its research Significance. Based on network hardware platform NetFPGA, this paper investigated the skills of flow classification, and designed a flow classification system by platform NetFPGA.NetFPGA is designed by Standford, aimed at creating a cheap and reusable hardware platform for researchers of cyber realm. Taking advantage of the FPGA, NetFPGA not only has high speed of hardware, but also has programmable, reusable ability like software. This paper is aware of the shortcomings of current flow classification, which is snow, delaying and steadfast, and applies the NetFPGA to flow classification area. The NetFPGA's works contain collecting flow information, saving information and controlling the network flow. It services to the classification software which works on the host PC of NetFPGA. The system has high-speed and high-performance ability.Analyzing host behavior of network and statistical feature of flow is critical mentality and main method of this thesis. The host behavior analysis contains dealing with IP address and port distinguishes, namely, categorizing network flow according to IP address and port. It also contains collecting packets and gathering the statistical feature of flow. Using machine learning technology, statistical feature analysis selects the fast, accurate and high-performance Naive Bayesian algorithm. This paper reforms the Naive Bayesian algorithm in the learning phase which supervised machine learning algorithm must contain. At end of the learning phase, it adds work to calculate posterior probability by flow training data. Based on the posterior probability, reforming algorithm saves a lot of calculating resources and has the ability of coping with high speed flow.The test results show that: combining NetFPGA with the reformed classifier, classification ability of the system has distinct improvement. The coping speed can be up to 700Mbps. The saved calculating resources can arrived at 40%. The test accurate parameters are similar to decision tree, neural net and SVM.