Research On Network Flow Correlation Technology Base On Convolutional Neural Network

With the rapid development of information technology,the function of Internet is more and more powerful,which greatly improves the quality of life.However,while the network brings all kinds of conveniences,the network security problems are also increasing.Especially in anonymous network or network environment based on stepping-stone,attackers often use their concealment to carry out network attacks and are difficult to trace.Therefore,it is necessary to study new flow correlation technology to trace and trace the attackers.Based on the research and analysis of current flow correlation technology,this thesis proposes a method based on flow feature maps and convolutional neural networks in view of the shortcomings of the correlation method that mostly uses statistical correlation algorithms for the flow correlation of current passive network traffic analysis,which can improve the detection accuracy by using the deep learning algorithm instead of the traditional statistical correlation algorithm.In view of the large storage and computation cost caused by the current method which needs to analyze and calculate the characteristic data of the maximum segment flow,a flow correlation method based on compression sensing and convolution neural network is proposed.The main research work of this thesis is as follows:(1)In view of the low detection rate of traditional passive traffic analysis method using statistical correlation algorithm and the difficulty to resist the sudden change of packet number,a new flow correlation method based on traffic characteristic graph and convolutional neural network is proposed.Firstly,the network flow at the entrance and exit is divided into time slots,the number of packets in the time slots is calculated,and then it is transformed into a characteristic graph.Because there are differences between the characteristic graphs of correlated and uncorrelated traffic,the convolution neural network is used to classify the characteristic graphs of correlated and uncorrelated traffic,so as to determine whether the traffic is correlated or uncorrelated.Finally,experiments show that this method can resist the mutation of packet number to a certain extent,especially in the case of small network interference,it has a high detection accuracy.(2)The traditional passive traffic analysis method often needs to analyze and calculate the characteristics of the maximum segment of traffic,which encounters the defects of storage and calculation overhead.A new method of flow correlation based on compressive sensing and convolution neural network is proposed.Firstly,the packet size and IPD traffic characteristics are selected as correlation feature,then the traffic characteristics are compressed based on linear projection of compressive sensing.Finally,the data of correlation and uncorrelation traffic characteristics are extracted by convolutional neural network and classified by SVM classifier to get whether the traffic is correlated or not.Finally,experiments and theoretical analysis show that this method can reduce the storage and time cost while still maintaining a high detection accuracy.(3)A flow correlation detection system is designed and developed.The system consists of user management and flow correlation detection.The running test shows that the system has constructed a friendly and simple function interface,and realized the function of flow correlation detection,and verified the usability of the flow correlation method based on flow characteristic graph and convolution neural network and the flow correlation method based on compression perception and convolution neural network to develop the prototype system.