Research On Network Traffic Classification Methods Based On Time Series Features

At present,the situation of network security is very serious,and network attacks become more and more frequent and hidden.Usually,network attacks need to be launched and spread by the network,and the network traffic will change accordingly with the outbreak of network attacks.Therefore,classifying network traffic and finding abnormal traffic in time is one of the most effective ways to detect network attacks.In recent years,a large number of machine learning algorithms have been introduced into the field of network traffic classification and achieved good classification results.However,in the current network traffic classification methods based on machine learning,there are some problems,such as the traditional machine learning relies too much on manual design features and the deep learning has black box attribute,which can't take into account the independent generation of features and the interpretability of features,resulting in the unsatisfactory classification effect and can't provide effective decision-making basis.In view of the above problems,combined with the obvious time series features of network traffic data,this paper uses the time series analysis method to propose a network traffic classification method based on time series features,aiming to achieve a network traffic classification algorithm with high accuracy,high efficiency and interpretability.The main work of this paper includes:(1)This paper explores a new method of autonomous extraction of network traffic features,uses the most recognizable shapelet subsequence in time series to represent network traffic for the first time,and constructs the optimal classification model based on Shapelet-Transform algorithm and support vector machine classification algorithm to realize network traffic classification.The experimental results show that the proposed method can realize the autonomous learning of network traffic characteristics and achieve the classification accuracy close to that of deep learning.At the same time,it gives the interpretable classification basis that deep learning method can not provide.(2)In view of the high time complexity of Shapelet-Transform algorithm,an improved algorithm based on GPU is proposed.The Shapelet-Transform computing logic is rewritten and deployed on GPU,and the powerful computing power of GPU is used to reduce the computing time.The experimental results show that the acceleration method based on GPU can greatly improve the classification efficiency without losing the classification accuracy.(3)In view of the situation that GPU acceleration cannot be used when the hardware is limited,a network traffic classification method based on Fast-Shapelet extraction is proposed.SAX technology and random masking method in Fast-Shapelet algorithm are used to accelerate the network traffic classification based on temporal characteristics,which greatly improves the speed of mining the best shapelet without increasing the hardware cost.