Resrarch On Getting Network Traffic Groundtruth Information Based On PDS Scheme

The popularity of network has led to rapid growth of the number of different applications that are derived from the Internet. Meanwhile, network users are putting forward more requests to the network, such as network security and bandwidth request, since when electronic commerce and P2P (Peer-to-Peer) network appear. In order to know better about the network environment, since1990s, methods aiming at high classification accuracy and efficiency turn up continually. However, for the datasets, classification methods and corresponding verification processes are all different from each other. It is hard to measure relative merits of these classification processes. GroundTruth can solve these problems effectively. To the GroundTruth construction methods, port identification and Deep Packet Inspection are the most commonly used ones. However, such methods cannot identify traffic effectively when facing with encrypted traffic or new type applications traffic. Based on the research point mentioned above, in this paper, we propose a set of network traffic classification process named PDS (combining methods of Port identification, DPI and Semi-supervised learning), and apply it to GroundTruth construction. In the end, we propose corresponding verification process to calibrate the correctness of PDS process. Experimental results show that based on port identification (port numbers are less than1024) and DPI, we could get70.6%identification rate in flow and76.6%in byte identification rate. Via PDS, we can get99.92%byte identification rate. In this paper, we construct an independent LAN environment using kernel monitoring to supervise BT traffic of P2P, and then we capture the corresponding traffic to verify the validity of PDS. Results show that we can achieve99.8%of the flow accuracy on P2P class.