| The rapid development of Internet technology has greatly changed people’slives, various network applications such as news browser, online shopping tool,video conference, chat tools and so on continue to emerge. With the advent ofmany new network applications and the fast transmission of massive data on theInternet, that recognizing the types of network applications as accurately andrapidly as possible and filtering out the illegal traffic of network application andlimiting the transmission ratio and speed of some applications which have largedata so as to ensure the key business and deepen the service quality is veryimportant to control and manage the network.With the rapid development of many new network applications in currentnetwork environment,the new types of network applications those userandom ports make the classification method of network traffic based onport matching technology out of work.Although the accuracy of the deep packetinspection classification method based on paylod is higher than others,it cost a lotto update the feature database and match the pattern signatures.So it doesnot adapt to network environment that has large traffic.However,the networktraffic classification method based on behavior only needs to get the basiccharacteristics to achieve a high efficiency,which has become the developmenttrend of network traffic classification. Classification method based on thebehavior of network flows has an assumption that objects belonging to thesame category have a stable set of features which can be any attribute informationabout the categories.This paper studies the behavior characteristics of network flows fromdifferent angles of view, and classifies flows of different network applicationswith these characteristics and data mining algorithms effectively. The main workis divided into the following four parts: At first, on the view of behavior characteristics, for the traditionalsupervised classification methods of machine learning use the samecharacteristics for all the applications which may make some characteristics havea good effect on distinguishing one or several types of applications, but had a badeffect on the others, we propose a method based on subspace clustering algorithmof network traffic classification. It can identify the new unknown applications.Secondly, this paper discusses the relationship between networkconnections, and the existence of link similarity principle in the network traffic isverified by experiments.We puts forward a new method based onthe link similarity of network traffic classification. This method only uses nodeinformation of network flow, instead of depending on the payload information.Finally, after researching on the interaction behavior of network flows, wefind the special interactive mode of P2P network and characterize it out throughthe graph metrics.Then we propose a method based on graph metrics drawn fromthe interactive characteristic of flows. |
