基于核函数的SOM网络流量分类方法

摘要

由于网络流量数据高度非线性,传统的自组织映射(self-organizing maps,SOM)网络对此分类的鲁棒性和可靠性较差,提出了一种基于核函数的SOM(kernel SOM,KSOM)网络流量分类方法.该方法用核函数代替原始数据在特征空间中映射值的内积,使输入空间中复杂的流量样本结构在特征空间中得到简化,实现对有多个统计特征属性的网络流量在应用层的分类.实验结果表明,KSOM 能识别新应用类型的流量,较传统的SOM更适合对网络流量进行分类,其分类准确率高于NB方法.%Due to network traffic is highly nonlinear, classical self-organizing maps (SOM) is worse robustness and reliability because it adopts Euclidean distance. A network traffic classification method named kernel-SOM (KSOM) is proposed, which adopts kernel function to replace Euclidean distance. This method can simplify the complicated flow sample from input space to feature space, so achieve good classification of network traffic that has several statistic feature attributes in application layer. Experimental results demonstrate that KSOM can identify flows which represent new application protocol. This method has more excellent performance than traditional SOM, and achieves higher classify accuracy than NB algorithm.