论文标题
基于更新机制的在线加密Skype识别
Online Encrypted Skype Identification Based on an Updating Mechanism
论文作者
论文摘要
机器学习算法在交通识别研究方面已获得突出，因为它提供了一种克服基于端口和深度数据包检查的缺点的方法，尤其是对于基于P2P的Skype。但是，最近的研究主要集中在基于全包数据集的流量识别上，该数据集在识别在线网络流量方面构成了巨大挑战。这项研究旨在通过将采样的流记录作为对象来提供新的流识别算法。该研究构建了Skype集作为数据集的流程记录，将固有的NetFlow和扩展流量指标视为特征，并使用基于快速相关的滤波器算法选择高度相关的功能。该研究还提出了一种新的NFI方法，该方法采用了贝叶斯更新机制来改善分类器模型。实验结果表明，所提出的方案可以比现有的最新交通识别方法获得更好的识别性能，并且在采样环境中分析了典型的特征指标。与其他方法相比，NFI方法提高了识别精度，并降低了误报和假否定性。
The machine learning algorithm is gaining prominence in traffic identification research as it offers a way to overcome the shortcomings of port-based and deep packet inspection, especially for P2P-based Skype. However,recent studies have focused mainly on traffic identification based on a full-packet dataset, which poses great challenges to identifying online network traffic. This study aims to provide a new flow identification algorithm by taking the sampled flow records as the object. The study constructs flow records from a Skype set as the dataset, considers the inherent NETFLOW and extended flow metrics as features, and uses a fast correlation-based filter algorithm to select highly correlated features. The study also proposes a new NFI method that adopts a Bayesian updating mechanism to improve the classifier model. The experimental results show that the proposed scheme can achieve much better identification performance than existing state-of-the-art traffic identification methods, and a typical feature metric is analyzed in the sampling environment. The NFI method improves identification accuracy and reduces false positives and false negatives compared to other methods.
