Research On The Network Traffic Classification Technology Based On Hidden Markov Models Of Network Protocols

The rapid development of network applications has increased the importance of theQoS. As the foundation of the network traffic management, the traffic identificationtechnology has been developing. Until recently the HMM-based traffic identificationmethod has been proposed. It considered both the timing and the statistical properties ofnetwork flow, and could identify unknown network flows well. But in the existingresearch, the HMM of network protocols was built artificially, and it could not meet theneeds of practical applications. Therefore a method to build the HMM automaticallywas proposed in this thesis. The correctness of the method was verified by experiments,and the theoretical significance and application value was further proved by using theHMM built automatically to identify traffic in campus. The main contents are asfollows:1．A method to build the HMM of network protocols automatically was proposed,and its accuracy was proved by an experiment. By studying both the timing andstatistical characteristics of network flows, the method to build the HMM automaticallywas put forward: To obtain the FSM of network protocols which reflected the timingcharacteristics, network packages were clustered by using density-based clusteringalgorithm; The feature vector was extracted, and its conditional distribution andtransition probability between states reflected the statistical characteristic; Thenparameters of HMM were trained under the guidance of the FSM so as to get thecomplete HMM. Selecting six kinds of typical network applications for experiments, thecorrectness of the method to build HMM automatically was proved.2．The DBSCAN algorithm was improved, and its performance was proved by anexperiment. By analysing its clustering principle, the DBSCAN algorithm wasimproved by reducing the number of region querying times, then it was used toclustering for building the HMM automatically. The experiment results showed that theefficiency of the improved DBSCAN was better than the original DBSCAN.3．The method of automatically constructing HMM was applied to our campus fortraffic identification. Based on the HMM built automatically, a traffic classifying testwas conducted. By comparing the accuracy with classifying results based on artificialHMM and methods on Weka, the application value was proved furthermore.