A Research On Time-frequency Analysis Of Network Flow Characteristics And Its Application

Network flow characteristics are abstract entities which can reflect the behavior pattern of network flows. They play an important role in Internet traffic classification, network node Indentification and network measurement. In dealing with network congestion and malicious attacks, understanding the network status and network traffic distribution, and for the Internet Service Providers to formulate traffic control strategies and service strategies, Network flow characteristics and the classification technologies based on them can provide support for data analysis and, therefore, has become a hotspot in the Internet research domain.Now the existing network flow characteristics are mostly the time-domain characteristics, and experiments show that the time domain parameters are susceptible to the network environment and result in instability classification. Therefore, we applied time-frequency representation to analyze the time-domain network flow characteristics. After time-frequency analysis we extract and form the time-frequency parameters of network flows or nodes, and then using machine learning methods to achieve network flow or node classification. Overall work is as follows:1. Time-frequency analysis and extraction of time-frequency parameters. In network traffic or node classification, each category has its own unique communication strategy, which can also be called "the characteristic fingerprint". In this paper, we chose and extracted the characteristics which can highlight the essential differences for each category, and then use the time-frequency analysis to handle these time-domain characteristics. Time-frequency analysis has several transform methods(using different time-frequency distribution functions). Theoretically the number of time-frequency distribution functions is infinite, and each function has different characteristics and different performance in different application. Therefore, we selected three representative time-frequency transform functions to analyze flows’ time-domain characteristics, including: short time Fourier transform, wavelet packet decomposition and Choi-Williams distribution. Then we analyzed the different performances in classification when using different time-frequency distributions. After time-frequency analysis is time-frequency parameters’ extraction. After the time-frequency analysis the signal is transformed into a time-frequency domain matrix, and the indetermination of matrix size means that the matrix can not be directly used for machine learning. So we use statistical approach and Renyi entropy to measure the time-frequency matrix. Then we extracted the time-frequency matrix into characteristic parameters for the subsequent classification.3. Time-frequency analysis in P2 P flow identification. First of all we analyzes the characteristics of P2 P category, that is, P2 P data is divided into same size blocks, so that it can achieve multi-point parallel transmission. A P2 P flow will cyclically transfer data block of similar size, while in other application flow we did not found this phenomenon. Therefore, we extracted the number of packets and count of bytes transmitted per second, formed the sequences into characteristics, and used time-frequency analysis method to measure them. While in P2 P applications transit, the client will access to resources to issue the request of the next data block’s transfer after receiving each data block. That will be showing some kind of synchronization between the two-way flows, so we regard bi-directional flow as the basic unit of classification.4. Time-frequency analysis in NAT node identification. NAT technology is used to translate multiple private IP addresses within a LAN into one legal IP address to the public. According to its operation principle, we found that the number of alive links of an IP address(which can be represented by the number of flows related to this IP address), has more significant randomness if this IP address belongs to an ordinary IP node, or more smooth variation if this IP belongs to an NAT node. Therefore, we count the number of alive links, new links and extinct links of an IP address per minute, and use them as time-domain characteristics. Then we use the time-frequency analysis tool to handle them. We regarded all the flows of one IP address as the basic unit of classification, and by this way we can identify NAT node(IP address) and the NAT flows on this node.