一种基于DPI自关联数据包检测分类方法

A self-associated method for packet detection classification based on DPI

摘要:

随着互联网的不断发展,越来越多的非传统业务兴起,由于大量采用迂回机制、加密隐藏技术,使得这些业务变得难以控制管理,影响传统业务的正常性能.现有识别方法普遍采用端口识别以及深度包检测技术DPI,难以识别迂回流量以及加密流量.因此本文提出一种基于DPI自关联检测分类方法,该方法首先通过与样本流之间七元组关联关系识别迂回流量,这部分称为强关联(SA),然后提取检测流特征值,通过本文提出的分类决策函数进行识别,这部分称为弱关联(WA),实验结果表明,该方法能克服DPI技术不能识别迂回流量以及加密流量的缺点,提高业务流识别准确率.

Abstract:

With the continuous development of the Internet, more and more nontraditional services are emerging and occupying a large amount of network bandwidth resources, which makes Internet services and security more and more difficult to be managed andaffects the normal performance of traditional services.The existing identification methods generally use port identification and DPI (Deep Packet Inspection) technology, which is difficult to identify roundabout traffic and encrypted traffic.This paper proposes a classification method based on DPI autocorrelation detection. This method firstly identifies the roundabout flow through the seventuple association relationship with the sample stream, called as strong autocorrelation (SA).Then, the detected stream features are extracted and identified by the classification decision function proposed in this paper. This part is called weak autocorrelation(WA). The experimental results show that the proposed method can overcome the DPI shortcomings in the roundabout and encrypted traffic identification and improve the traffic flow identification accuracy.