A Research On The Time-Varying Characteristics Of The Network Flow

With the expansion of the size of the Internet and network traffic, how to take charge of the network traffic and the users’ behaviors has become a serious problem to solve, and how to identify network flow and per-host based on the features of network flow and per-host has become a hot topic. However, the existing network traffic identification methods are mainly based on the time-domain statistical characteristics, so it is lack of stability. Moreover, there is few research on the identification of per-host.Based on the research status of the identification of network flow and per-host, this thesis makes a detailed analysis on the time-varying characteristics and machine learning theory, then proposes a method to extract the time-varying characterisitics of the network traffic and per-host. Overall work is as follows:1. Time-varying analysis of the network flow. Every network application and host has its own unique mode of communication, and the time-varying characteristics can describe the different patterns of network flow. This thesis describes in detail the extraction method of the time-varying characteristics of the time-frequency transform, and chooses 12 kinds of different time-frequency transforms to describe it. However, the time-frequency transform matrix is too huge too handle, so this thesis chooses Renyi entropy and singular value decomposition to extract the characteristics of the matrix.2. Identification of the network flow based on the time-varying characteristics. Network application can be divided into different categories, and every category has its unique mode of communication. This thesis divides the application into 34 kinds of category and then analyze the trends based on bytes transmitted per second. The result shows that every category has its own time-varying characteristics. So this thesis chooses the number of bytes transmitted per second as the the original time-domain characteristics to be transformed, and uses statistical theory, Renyi entropy and Singular Value Decomposition to reduce the dimensions of the time-frequency matrix. Finally, this thesis uses the C4.5 decision tree algorithm to identify the network traffic. The results shows that the long flow can be identified more easily when use the time-varying features, and combine time-frequency characteristic with statistical characteristic can achieve a much better result.3. Identification of the per-host based on the time-varying characteristics. Different from the network traffic identification, we should use the host level features to identify the host. This thesis compares the variation trend of different host, and chooses statistical characteristic, differential characteristic and time-frequency characteristic to identify each host. The result shows that identifying host based on these three features in a small network can achieve a good result.