基于会话的应用特征自适应提取

摘要

提取网络应用特征,对于准确地识别应用层流量,进一步提供差异性服务、QoS保障、入侵检测、流量监控以及计费管理等应用具有很重要的意义.然而目前还没有有效的应用特征自动提取方法.提出了一种自动提取应用特征的新方法,该方法能够从应用层的会话中提取频繁项集,经过冗余项过滤及基于识别率的自适应特征选择获取识别应用协议的最小特征集.采用识别率和正确率对所提取的特征进行评估.实验结果表明,该方法是有效的,所提取的特征具有准确性,能用于应用层流量的精确识别.%Accurate identification of application layer traffic is important for many Intemet applications, such as provision of differentiated services, quality of service(QoS) guarantee, intrusion detection, traffic monitoring, accounting, and so on. However,there is no effective method which can automatically extract application signatures. In this paper,a novel method based on frequent item mining was presented,which can automatically extract frequent set from sessions of any application protocol, reduce redundancy of the frequent set based on adaptive filtering rules, and obtain the application signatures. Identification rate and precision rate were applied to verity the extracted signatures. Experiment results show that this method is effective and the extracted signatures are subtle. Therefore it can be used to accurately identify the corresponding application.