Study On Related Issues Of Flow-based Quick Classification

Nowadays with the rapid development of new generation of Internet in China, the scale of Internet expanding continuously and the new application of network sustained to growth. As is show by statistics, up to the end of December2009, Chinese netizens scale achieve457million people, internet popularity rate reaches34.3. On the one hand, the expansion of the network information have made network traffic increased exponentially, this aggravated the occur of network congestion, network service quality has dropped sharply and affect users’satisfaction. On the other hand, many kinds of network applications not only lick up more network resources but also threaten network security. In order to better master the behavior situation of the network traffic, network managers need effective method to monitor and control the network traffic, and provied timely and accuratly analysis for all kinds of businesses which the network carried on. However, classifying the network traffic rapidly and accuratly is the premise and foundation of that wish.According to the principle of network, IP packets, which is generated by one interactive of the network applacation, all have the same5-tuples (source IP, source port, destination IP, destination port, protocol). On the contrary, in a period of time, the IP packets which have the same5-tuples must belong to a same applicaton type. So, now on the traffic classification prevailing practice is clustering IP packets into flow based on5-tuples, and then do classification based on the flow. Compared with earlier classification based on packet, flow-based classification reduced the number of classification actions, and flow contains abundant information.For all these reasons, this paper studies the quick classification technology which based on the flow. Significant classification feature and appropriate classifier are the two major factors influence the classification results. And this paper carries out the research on these two aspects.This paper studies the problem of classification firstly, and proposes two features:ACK-Len ab and ACK-Len ba, in which the ACK-Len ab is the total data length sends from requester to responser before the first ACK packet arrived, and ACK-Len ba is denoted conversely. The analysis and experiments show that these two features possess typicality, using them to classification can obtain preferable classification effect. At the same time, to compute these two features only use the data length of the first few packet on the flow, it can classify the flow in the early time of the flow arrived. And this method only to store the size of the few early data packet of the flow, greatly save storage space of the machine, opens a range of new possibilities for online traffic classification.Then studies the problem of the classifier. Instinctively, the lesser features, the lesser judgement and calculation need to do when classification, so based on the thought of combining the feature selection and traditional classification method to establish classifier, this paper proposed quick flow classification method which based on rough set. This method using rough set algorithm to reduce data feature, and establishing classification modle on the reducing feature set. The experiment indicates that the rough set combing with Bayesian networks can achieve the best classification result. And to classifying the flow at the reducing feature set, the classification speed and accuracy of the classifier are improved.