| In recent years, the application-layer protocol classification method has been facing with great challenges because of the rapid growth of Internet business amount and the keep coming up of new Internet protocols. In case of that data-flow classification plays an important role in intrusion-detection, flow control, etc, it has practical and research significance for finding out data-flow classification algorithm with high efficiency and good accuracy. This paper is devoted to study the real-time traffic classification method, serial connect well-known port number module block with flow feature module block and character-word module block to identify protocol type precisely.The thesis is focus on traffic classification techniques, and the main work is listed as follows:1. Primary traffic classification based on well-known port number module block:Traffic classification based on well-known port number was the firstly used technology in flow classification area, used to be the major method for a long period. It presents a low time-complexity, and simple algorithm theory. However, along with the dramatically changes happened to Internet environment, the thesisbecame imitated. In our research, we use well-known port number module block to do the pre-classification work, the experimental results shows that the proposed method is able to identify almost 40% of the total data-set.2. Flow features selection & reduction:Traffic classification using payload-independent flow features has been an active and difficult research topic for recent years. In this unit, firstly we use greedy-forward-C4.5 algorithm to perform attributes reduction, then convert the result and create a new extended feature set using easy-obtainable attributes which is much more fitted to deal with the real-time classification affair. After that, we do reduction on the new attribute set again, using training set to help obtaining attribute subset and building a classifier. This procedure could recognize some more Internet applications. 3. Application-layer protocol character-word matching phase:traffic classification method based on character-word matching has the obviously characteristics of high accuracy, high complexity, large system resources occupation, etc. Hence, we put this phase as the final recognizing part, taking charge of classifying left flow sets that have not been identified by the other 2 module blocks. During this process, we find the protocol regular expressions in L7-filter tool, try to raise a shortest replacer while guarantying high classification accuracy.4. Recognizing application-layer protocol by serially connect 3 flow classification module block:Considering that pure character-word matching method though acquire high accuracy, however it is always time-consuming, while the well-known port number and flow features based classification method often do not contain sufficient information to allow for an accurate methodology. Thus, in this article we perform real-time traffic classification based on 3 serially connected module blocks, firstly use the well-known port number module block to figure out part of the flow set, then the flow features classification module block, finally the character-word matching module block. For real- time needs, the flow statistics attributes being used are all extracted from the first 5 packets of every flow. |
