Research On Service Classification Based On Regular Heartbeat Behavior

Heartbeat mechanism is a common technology to ensure the continuous operation and uninterrupted service of network applications and network devices.Normal services in the Internet,including instant messaging software and Internet of Things system,use the regular heartbeat mechanism.The heartbeat packets generated by them have obvious regularity and periodicity,and the corresponding heartbeat data flows show regular heartbeat behavior.It is of great significance for Internet management and security protection to detect and classify heartbeat data flows with regular heartbeat behavior in massive network traffic quickly and accurately.It is also a new idea in the research on network traffic classification.The research work of this thesis is focused on the regular heartbeat behavior,by researching methods for detecting heartbeat data flows and classifying their services.The main contributions of this thesis are as follows:1)In order to detect the heartbeat data flows in network traffic,two methods for regular heartbeat behavior detection are proposed.Firstly,the regular heartbeat behaviors are divided into the TCP KEEP-ALIVE heartbeat behavior in transport layer and the heartbeat behavior in application layer.The former has a fixed working mechanism,while the latter has periodicity in time series.Then according to the two kinds of regular heartbeat behaviors' characteristics,the method for TCP KEEP-ALIVE heartbeat behavior detection in transport layer based on rule and the method for heartbeat behavior detection in application layer based on Fourier transform are proposed.These two methods can detect the heartbeat data flows which contain the TCP KEEP-ALIVE heartbeat behavior in transport layer or the heartbeat behavior in application layer based on TCP or UDP protocol.The test in actual network traffic at the boundary of a campus network show that the methods can effectively detect the heartbeat data flows with regular heartbeat behavior.2)In order to classify the detected heartbeat data flows,a method for known service classification based on regular heartbeat behavior is proposed.Because there are many kinds of services,it is impossible to construct classifiers and use supervised learning algorithm to classify them.So,on the basis of formulating the service classification rules,a method for known service classification based on Nondeterministic Finite Automaton is designed.On this basis,the method is combined with the method for regular heartbeat behavior detection to complete the programs for regular heartbeat behavior detection and service classification in the end system and network boundary.They can respectively detect and classify the regular heartbeat behaviors in the network traffic of end system and network boundary.The test based on the real environment shows that the method can effectively classify some heartbeat data flows.3)In order to solve the problem that the service classification rules used by the method for known service classification need to be extracted by manual observation,a method for unknown services to generate service classification rules based on machine learning algorithm is proposed.According to the characteristics of popular and common service heartbeat data flows with a certain scale,20 features of flow-based behavior are selected and the clustering of unknown services based on these features and unsupervised learning algorithm DBSCAN is completed.On this basis,a method for generating service classification rules based on algorithm Apriori is proposed.The service classification rules generated automatically can be used to support the method for known service classification.Finally,the test in actual traffic at the boundary of a campus network shows that with the service classification rules generated by this method,the method for known service classification can classify most of the regular heartbeat behaviors in the network traffic with high accuracy.