准确的流量分类是网络管理和网络安全的有效保障。近年来基于机器学习的网络流量分类备受关注，特征选择对于机器学习的分类效果有重要影响。但使整体分类性能达到最优的特征选择子集，并不一定使特定类别的分类性能达到最佳，这降低了分类性能可达到的上限，对此提出基于改进的一对一算法的流量分类模型。首先采用一对一的思想将流量多分类任务拆解为多个相互独立的二分类子任务，分别对任意两类流量进行特征选择和流量分类。所有子任务的分类结果采用Stacking策略结合。实验表明，多种机器学习算法与特征选择算法应用于该模型的准确度较经典模型均有提升。
Accurate traffic classification is an effective guarantee for network management and security. Machine learning-based internet traffic classification became particularly notable in recent years, and feature selection had an important impact on the performance of machine learning. However, the feature selection subset that optimizes the overall classification performance is not the subset that optimizes the classification performance of a particular class, which reduces the upper limit of classification performance. Therefore,a new traffic classification model based on the improved one-versus-one method is proposed. In the new traffic classification model, traffic multi-classification task is split into multiple independent sub-tasks.Then feature selection and traffic classification are performed on any two classes of traffic,and the Stacking strategy is used to combine the results of all sub-tasks. The experiments show that the applications of several machine learning and feature selection algorithms to this model improve accuracies compared with those to the classical model.
[1] IANA.IANA port number list[EB/OL]. (2003-06-14)[2018-10-18].http://www.iana.org/assignments/port-numbers.
[2] Kim M,Won Y J,Hong J W.Application-level traffic monitoring and analysis on IP networks[J].ETRI Journal,2005,27(1):22-42.
[3] Paxson V.Empirically derived analytic models of wide-area TCP connections[J].IEEE/ACM Transactions on Networking,1994,2(4):316-336.
[4] Paxson V,Floyd S.Wide area traffic:the failure of Poisson modeling[J].IEEE/ACM Transactions on Networking,1995,3(3):226-244.
[5] Zuev D,Moore A.Traffic classification using a statistical approach[C]//Proceedings of PAM'05. Berlin:Springer-Verlag, 2005:321-324.
[6] Moore A W, Zuev D.Internet traffic classification using Bayesian analysis techniques[J].ACM Sigmetrics Performance Evaluation Review,2005,33(1):50-60.
[7] Roughan M, Sen S,Spatscheck O, et al. Class-of-service mapping for QoS:a statistical signature-based approach to IP traffic classification[C]//Proceedings of IMC'04.New York:ACM,2004:25-27.
[8] Mcgregor A, Hall M, Lorier P, et al. Flow clustering using machine learning techniques[C]//Proceedings of PAM'04.Berlin:Springer-Verlag,2004:205-214.
[9] Erman J, Arlitt M, Mahantii A.Traffic classification using clustering algorithms[C]//Proceedings of the 2006 International Conference on Sigcomm Workshop On Mining Network Data.New York:ACM,2006:281-286.
[10] Erman J, Mahanti A, Arliyy M.Internet traffic identification using machine learning[C]//Proceedings of the 49th IEEE Conference on Global Telecommunications.San Francisco:IEEE,2006:1-6.
[11] Yu L,Liu H.Feature selection for high-dimensional data:a fast correlation-based filter solution[C]//20th International Conference on Machine Learning.Washington DC:IMLS,2003:856-863.
[12] Hsu C W,Lin C J.A comparison of methods for multi-class support vector machines[J].IEEE Transactions on Neural Networks,2002,13(2):415-425.
[13] Wolpert D H.Stacked generalization[J].Neural Networks,1992,5(2):241-259.
[14] Moore A, Zuev D,Crogan M,et al.Discriminators for use in flow-based classification[M]. London:Queen Mary University of London,2005.
