一种基于DPI自关联数据包检测分类方法
A self-associated method for packet detection classification based on DPI
作者：贾军(四川大学计算机学院,成都 610065)；杨进(四川大学网络空间安全学院)；李涛(四川大学网络空间安全学院)
Author：JIA Jun(College of Computer Science, Sichuan University, Chengdu 610065, China)；YANG Jin(College of Cyberspace Security, Sichuan University, Chengdu 610065, China)；LI Tao(College of Cyberspace Security, Sichuan University, Chengdu 610065, China)
收稿日期：2018-05-08 年卷（期）页码：2019,56(1):29-36
期刊名称：四川大学学报: 自然科学版
Journal Name：Journal of Sichuan University (Natural Science Edition)
关键字：自关联；DPI；关联流量；业务识别
Key words：Autocorrelation; Deep packet detection(DPI); Associated flow;Traffic identification
基金项目：国家重点研发计划（2016yfb0800604, 2016yfb0800605）; 国家自然科学基金（61572334,U1736212）; 四川省重点研发项目（2018GZ0183）
中文摘要
随着互联网的不断发展,越来越多的非传统业务兴起,由于大量采用迂回机制、加密隐藏技术,使得这些业务变得难以控制管理,影响传统业务的正常性能.现有识别方法普遍采用端口识别以及深度包检测技术DPI,难以识别迂回流量以及加密流量.因此本文提出一种基于DPI自关联检测分类方法,该方法首先通过与样本流之间七元组关联关系识别迂回流量,这部分称为强关联(SA),然后提取检测流特征值,通过本文提出的分类决策函数进行识别,这部分称为弱关联(WA),实验结果表明,该方法能克服DPI技术不能识别迂回流量以及加密流量的缺点,提高业务流识别准确率.
英文摘要
With the continuous development of the Internet, more and more non traditional services are emerging and occupying a large amount of network bandwidth resources, which makes Internet services and security more and more difficult to be managed andaffects the normal performance of traditional services.The existing identification methods generally use port identification and DPI (Deep Packet Inspection) technology, which is difficult to identify roundabout traffic and encrypted traffic.This paper proposes a classification method based on DPI autocorrelation detection. This method firstly identifies the roundabout flow through the seven tuple association relationship with the sample stream, called as strong autocorrelation (SA).Then, the detected stream features are extracted and identified by the classification decision function proposed in this paper. This part is called weak autocorrelation(WA). The experimental results show that the proposed method can overcome the DPI shortcomings in the roundabout and encrypted traffic identification and improve the traffic flow identification accuracy.
【关闭】
