互联网中基于用户连接图的流量分类机制.pdfVIP

第35 卷第4 期 电 子 与 信 息 学 报 Vol.35No.4 2013 年4 月 Journal of Electronics Information Technology Apr. 2013 互联网中基于用户连接图的流量分类机制 张 震* 汪斌强 陈鸿昶 马海龙 (国家数字交换系统工程技术研究中心 郑州 450002) 摘 要：针对机器学习分类算法的“概念漂移”现象，该文提出了一种基于用户连接图的(Host Connection Graph, HCG)流量分类机制。算法将{IP Address, Port}作为用户唯一标识，构建了用户连接图，提出了“用户相似度” 的概念；应用“图挖掘”理论将用户连接图划分为互不相交的行为子簇，使得用户之间的相互通信抽象为一种“社 会团体”；通过定义基于信息熵的“用户行为模式”(UBM)，分析了各个行为子簇背后表现出的业务特征，并使用 “UBM+Port ”对用户行为子簇进行了业务标签映射，实现了流量分类的目的。仿真实验表明：在不牺牲识别准 确率的前提下，算法不仅能克服“概念漂移”问题，还能有效降低算法的计算复杂度。 关键词：流量分类；用户连接图；用户相似度；图挖掘 中图分类号：TP393 文献标识码： A 文章编号：1009-5896(2013)04-0958-07 DOI: 10.3724/SP.J.1146.2012.01040 Internet Traffic Classification Based on Host Connection Graph Zhang Zhen Wang Bin-qiang Chen Hong-chang Ma Hai-long (National Digital Switching System Engineering Technological RD Center, Zhengzhou 450002, China) Abstract: Considering at the concept drift issue of machine learning identification, a novel algorithm called traffic classification based on Host Connection Graph (HCG) is proposed. Considering {IP Address, Port} as the unique user identifier, HCG constructs a host connection graph and innovates the concept of user similarity. Based on the theory of graph mining, social community is abstracted from communications among hosts by partitioning the graph into mutually intersectant behavior clusters. In order to reach traffic classification, HCG not only conceives a definition called User Behavior Mode (UBM) to analyse the implicit traffic characteristics, but also maps application labels to every host behavior by employing UBM and Port. Finally, simulations are conducted based on the real network trace. Res