The Study Of The Identification Of Abnormal Traffic Based On Sparse Autoencoder And Combining Classifier

With the development of 4G business,mobile terminals become the main media for users to surf the Internet,promote the rapid change of Internet business,and become a strong traction to improve social productive efficiency.But the equirements of users become higher for the 4G network experience,the main reason that affects the users' 4G network experience is the slow speed and abnormal traffic,and the expenses caused by abnormal traffic has a direct impact on satisfaction of users' 4G network experience.How to solve the conflict effectively between network quality and users demands is becoming more and more important in this environment.This paper overcomes the difficulty of abnormal traffic without clear identification,and introduces the external complaint information.When users suspect traffic with too fast or different from perception,then they are marked as positive samples.This paper analyzes characteristics of abnormal traffic users from various dimensions by using data of complaint,the traffic data of using in the daily,the traffic data of each time in the day of abnormal traffic,the traffic data of using by APP in the day of abnormal traffic,the terminal data and its expanded information based on these data.This paper analyzes mainly the delay of complaint time relativing to the time of abnormal traffic in respect of the complaint characteristic,in respect of behavior characteristic of using traffic,more traffic used and large fluctuation in the day of abnormal traffic,in respect of time characteristic of the Internet,short-time outbreak of abnormal traffic for general user,malicious APP consumes a lot of traffic in a short time,and in respect of APP and terminal system characteristics,the first 20 APP of the different terminal systems are basically consistent which leading to abnormal traffic,and the highest proportion of APP that causes traffic abnormality is the unknown software or program.Based on the data information contained in each protocol of OSI seven layers model,this paper broadens the index system of abnormal traffic identification,it selects and derives the important information of indicator that reflect the whole process of network behavior.There are seven categories,including data package,speed,HTTP behavior,address and port,TCP transport,DNS request and comprehensive overview.Due to the high dimensionality of network index,this paper proposes an improved model,uses sparse autoencoder to extract features,assigns automatically weights for different indicators,compresses the 41 indicators of the index system of abnormal traffic identification to 15 indicators,and uses logistic regression,k-nearest neighbor and decision tree classifier to contrast the effect of the model by using index data extracted by sparse autoencoder and 41 index data.The result shows that the effect of the model by using index data extracted by sparse autoencoder is better than the effect of model by using 41 index data under the three classifiers.Therefore,the method of sparse autoencoder not only has better effect of model,but also reduces the space complexity and computational complexity of machine learning algorithm to some extent.In order to improve the effect of model,this paper uses stacking ensemble learning to achieve combining classifiers.Firstly,the model is constructed by three base classifiers:logical regression,K nearest neighbor algorithm and decision tree,secondly,the output of the three base classifiers is combined as the input of the second layer classifier,and the second layer classifier uses the logic regression algorithm to achieve the final combining classifiers through learning.The accuracy and AUC of the combining classifiers is higher than every base classifier,the accuracy is 95.14%,the value of AUC is 93.12%.Finally,this paper summarizes the contents of main work,and prospects the next stage research according to the shortage of the paper.