| Protocal identification is essential to a broad range of network applications, but it is challenging because of the continued evolution of applications, especially of those with a desire to be undetectable. The diminished effectiveness of port-based identification and the overheads of deep packet inspection approaches motivate people to classify traffic by exploiting distinctive flow characteristics of applications when they communicate on a net work.This papper analysis several main application protocols deeply and then identifies them using flow statistics.Based on the studies of application protocol identification, series of studies have been taken out in mainly three ways:First, protocol feature extraction and establishment of its feature data format; second, reducing the dimension of the feature space, also known as feature selection; third,creation of a statistical model. In feature processing, a special data structure has been adopted. Each feature is represented by a counter vector and a probability vector.In feature-selection, under fully studies upon feature-selection algorithms:FR and FSS, two hybrid feature-selection algorithms have been proposed, and compared with experiments of several commonly used suggest that the proposals take advantage over others. As to statistical model, the HCM clustering algorithm has been taken, In order to handle the special characteristics of the future structure, the HCM algorithm has been improved partly, in which the Kullback-Leible divergence (also known as KL divergence) taken place the commonly used Euclidean distance, and two important parameters in the model have been fully studied, on of which is the selection of K value of HCM and the other is settings of threshold of specific protocol identification utilizing the K-L divergence. For model library training, the idea of a semi-supervised has been taken which training with a few of labeled and many unlabeled flows. Finally, it has been proved that the accuracy and performance of the method which utilizing flow statistics for protocol identification can be fully fulfilled. |
