Research On Network Traffic Classification Methods Based On Transfer Learning And Online Learning

Today, a variety of network information and applications generate frequent with the rapid development of information technology. A large number of viruses, Trojans and non-key applications constantly damage, impact networking. These threat network security and transfer of key applications seriously that causes widespread concern in the world. It is particularly important to use an effective method of network traffic identification and classification. In recent years, network traffic classification technology has become an important method for protecting network security.Due to the dynamic ports used and payload of data encryption, these traffic classification methods which based on port and payload are no longer suitable for recognition using dynamic ports and encrypted data, makes the research point gradually shift to using statistical characteristics and machine learning to network traffic classification. However, machine learning method has two mainly problems: firstly, it has poor classification accuracy while the train dataset and the test dataset have big difference. Secondly, traditional machine learning using offline to train a model and recognition classes by online, it can't achieve real-time identification of network traffic. For the weakness and insufficient of traditional machine learning methods, this paper proposes three traffic classification methods based on transfer learning(TL) and online learning which can solve these problems.In this paper, we take the network traffic as the research object. Using the statistical characteristics, transfer learning and online learning methods. We proposed a novel network traffic identification method which can effectively solve the deficiency of the traditional machine learning method. Ours proposed method can with high accuracy and high efficiency to recognition network traffic while the training dataset and the testing dataset are not satisfied the same distribution. The mainly work of this paper is divided into three parts:Firstly, with the inductive transfer learning method, we use the Tr Ada Boost(a kind of Ada Boost modification applied to transfer learning) as the learning framework and use the Maximum Entropy Model(MEM) as the base classification learner. Thus, we can get a lot of useful knowledge from source domain to assist target domain samples classification. At last, we implemented the network traffic identification.Secondly, we use the transductive transfer learning method. There are not labeled samples in the target domain, the useful knowledge of the source domain is transferred to the target domain through the K-means and KNN methods, and a variety of machine learning methods are used to identify the network traffic, and the classification results are significantly improved.Thirdly, due to the traditional machine learning methods can't achieve the effect of real-time classification. In this paper, we use the online learning method(Online NB, Online LR) to identify the P2 P traffic. The method does not need to save a large number of training samples and can be updated in real time, which can ensure the real-time network traffic classification. At the same time, we also get high classification accuracy.To sum up, this paper proposes two novel network traffic classification methods: transfer learning makes full use of the existing knowledge assist the test dataset recognition. Online learning can reduce the time of training model and achieve the real-time identification of network traffic which can effectively solve the problems of traditional machine learning methods. The methods proposed in this paper will also become a development trend of network traffic classification.