Research And Application Of Network Traffic Classification Methods Based On DPI And DFI

With the popularization of Internet activities and their information terminal products such as e-commerce,network video,smart phone,network office,network traffic is increasing day by day,which brings many challenges to network management,such as network service quality problems,network security,network bandwidth,network illegal information transmission problems and so on.An important technique to solve these problems is network traffic classification.1)Aiming at the problems of low efficiency of online unencrypted traffic classification,insufficient granularity of recognition and incomplete recognition,several typical pattern matching algorithms are studied and the efficient matching performance of AC multi-mode matching algorithm is pointed out,then this paper selects the nDPI open source deep package inspection library with built-in AC algorithm to design a DPI(Deep Packet Inspection)network traffic classification system.And the nDPI feature library is expanded through a lot of experimental research on captured packets.Finally,each module of DPI traffic classification system is designed in detail.Experimental results show that this method can achieve more comprehensive classification of online unencrypted traffic.2)In order to improve the assurance ability of the service quality of multimedia applications,the traffic control mechanism based on Linux system is studied.By increasing and decreasing the priority of the multimedia traffic and the file download traffic identified by DPI,the online traffic classification method designed by DPI is applied to the traffic control.The results show that,with a limited bandwidth of 15 Mbps,downloading files while watching HD videos,video playback could alleviate the phenomenon of jam,and the desired goal is achieved.3)In order to solve the problem that the classification accuracy of traditional supervised classification model is low when only a few encrypted traffic samples with labels are available,the method of encrypted traffic classification based on DFI(Deep Flow Inspection)and semisupervised classification is studied,and a semi-supervised classification model is designed.Through in-depth analysis of the deficiencies of the original methods,two improvements have been made: first,the clustering process in the traditional model is improved,and the BIRCH clustering is used to replace the original clustering algorithm,which greatly reduces the training time of the model to less than 1 second;the "simple majority" category mapping principle in the original clustering category mapping process is improved,which improves the classification accuracy of the model.The above two improvements have been verified by a large number of experiments in this paper.It improves the efficiency and accuracy of encrypted traffic classification.