用最少包数快速准确识别网络流量类型,还能发现未知应用。
FastFlow: Early Yet Robust Network Flow Classification using the Minimal Number of Time-Series Packets
- 通过时序统计与滑动窗口,抗乱序地提取流量特征。
- 仅需平均8.37个包、0.5秒,准确率达91%以上。
- 适合需要早判、鲁棒性强的实时网络监控场景。
网络流量分类对运营商分析多媒体应用使用模式和优化配置至关重要。在高速链路上,服务提供商期望流量分类器能在极早期、用最少初始包完成分类,且能抵御包序混乱、识别未见过的流量类型,现有方法难以兼顾。本文提出FastFlow,一种基于时序的流量分类方法,可将流量归为已知类型或未知类型,并动态选择最小必要包数以平衡准确率与效率。首先,设计了双粒度流表示法(每包与每槽),实现精确统计并增强对包序混乱的鲁棒性;其次,构建基于强化学习训练的LSTM序列决策模型,动态决定达到置信分类所需的最少时序数据点。在公开数据集上验证表明,该方法在早期分类中表现优越。实际部署于校园网一周内处理超过2290万条流量,覆盖7类应用和33个内容提供商,结果表明:平均仅需8.37个包、0.5秒即可实现91%以上的应用类型准确率,内容提供商识别准确率超96%。
原文摘要 · Abstract (English)
Network traffic classification is of great importance for network operators in their daily routines, such as analyzing the usage patterns of multimedia applications and optimizing network configurations. Internet service providers (ISPs) that operate high-speed links expect network flow classifiers to accurately classify flows early, using the minimal number of necessary initial packets per flow. These classifiers must also be robust to packet sequence disorders in candidate flows and capable of detecting unseen flow types that are not within the existing classification scope, which are not well achieved by existing methods. In this paper, we develop FastFlow, a time-series flow classification method that accurately classifies network flows as one of the known types or the unknown type, which dynamically selects the minimal number of packets to balance accuracy and efficiency. Toward the objectives, we first develop a flow representation process that converts packet streams at both per-packet and per-slot granularity for precise packet statistics with robustness to packet sequence disorders. Second, we develop a sequential decision-based classification model that leverages LSTM architecture trained with reinforcement learning. Our model makes dynamic decisions on the minimal number of time-series data points per flow for the confident classification as one of the known flow types or an unknown one. We evaluated our method on public datasets and demonstrated its superior performance in early and accurate flow classification. Deployment insights on the classification of over 22.9 million flows across seven application types and 33 content providers in a campus network over one week are discussed, showing that FastFlow requires an average of only 8.37 packets and 0.5 seconds to classify the application type of a flow with over 91% accuracy and over 96% accuracy for the content providers.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。