互联网未知流量聚类与识别技术研究

Network traffic identification is crucial for cyber space security, and it has a wide variety of current and future networking and security services. The key technical challenge in this area is to identify unknown network traces from mixed Internet traffic. Note that the objective of this project is to develop schemes for automatically identifying the network traces of unknown applications. The basic idea of our approach is as follows: First of all, we group raw Internet traffic into several clusters based on a multiple stage clustering algorithm. Then, we use the knowledge of flow correlations to merge clusters that belong to a specific application. Finally, according to the merged samples, we propose a language model based approach to robust application identification for unknown network traces. Therefore, this project has great academic value and practical significance for mappings of unknown network traces to known network applications.

网络流量识别是开展网络空间安全研究必不可少的技术基础与手段，具有重要的理论意义和实际价值，其关键的技术难题在于未知流量的识别问题。本项目针对未知流量识别这一国际公认的技术挑战展开研究工作，拟通过粗细粒度多阶段聚类、基于关联的流量簇合并等方法获取少量训练样本，并基于语言模型构建强鲁棒性的流量分类模型来实现未知流量的自动化识别。本项目所预期的关键技术突破将为进一步解决未知流量与已知应用的映射等深层次识别问题奠定研究基础。

网络流量识别是开展网络空间安全研究必不可少的技术基础与手段，具有重要的理论意义和实际价值，其关键的技术难题在于未知流量的识别问题。本项目针对未知流量识别这一国际公认的技术挑战展开研究工作，拟通过粗细粒度多阶段聚类、基于关联的流量簇合并等方法获取少量训练样本，并基于语言模型构建强鲁棒性的流量分类模型来实现未知流量的自动化识别。本项目所预期的关键技术突破将为进一步解决未知流量与已知应用的映射等深层次识别问题奠定研究基础。