Traffic Analysis For Internet Application Identification

As the development of Internet, a series of new technique and applications come up. Compared to the high developing speed of Internet, researches on the behavioral features of the Internet are not sufficient. The Internet is a social system, the behavior of its customer has a great influence on it. How to understand the statistical characteristics of this system is the foundation of network design and management.The development of P2P technique has made it one of the most resource-consuming applications in the Internet. Distributes system is non-optimal and uncontrollable, these disadvantages make P2P applications have potential security issues, and take up much more network resources. How to identify and control P2P traffic is gaining more attention of network ISP, and is becoming one of the most challenging works in network traffic identification.This thesis proposed a host-session P2P classifier using machine learning algorithms. On transport layer and network layer, we analyzed TCP and UDP respectively to avoid the differences caused by the transport layer protocol, and refined the statistical method of flow attributes. On application layer, we analyzed the communication pattern of different applications, and brought up representative flow features. The host-layer of this2-layer classifier focuses on the statistical characteristics of the host machine, while the session layer monitors the flow features of every single flow in a host. We use the parameter of recognition cost, which combines false positive rate and false negative rate together, to evaluate the performance of flow classification. The classification is based on BP neural network. The method is proved that two classifiers can achieve higher accuracy if the specific parameter of host behavior classifier is bigger than session classifier’s minus one, and the innovative algorithm has less complexity of time and space. The experimental results show that the performance parameter of user behavior classifier is better than session classifier and easier to access. This method can also be used for online traffic identification and outperform traditional methods.