Network traffic is very important for testing network equipment, network services, and security products. A new method of generating traffic based on statistical packet-level characteristics is proposed. In every time...Network traffic is very important for testing network equipment, network services, and security products. A new method of generating traffic based on statistical packet-level characteristics is proposed. In every time unit, the generator determines the sent packets number, the type and size of every sent packet according to the statistical characteristics of the original traffic. Then every packet, in which the protocol headers of transport layer, network layer and ethernet layer are encapsulated, is sent via the responding network interface card in the time unit. The results in the experiment show that the correlation coefficients between the bandwidth, the packet number, packet size distribution, the fragment number of the generated network traffic and those of the original traffic are all more than 0.96. The generated traffic and original traffic are very highly related and similar.展开更多
With the increasing proportion of encrypted traffic in cyberspace, the classification of encrypted traffic has becomea core key technology in network supervision. In recent years, many different solutions have emerged...With the increasing proportion of encrypted traffic in cyberspace, the classification of encrypted traffic has becomea core key technology in network supervision. In recent years, many different solutions have emerged in this field.Most methods identify and classify traffic by extracting spatiotemporal characteristics of data flows or byte-levelfeatures of packets. However, due to changes in data transmission mediums, such as fiber optics and satellites,temporal features can exhibit significant variations due to changes in communication links and transmissionquality. Additionally, partial spatial features can change due to reasons like data reordering and retransmission.Faced with these challenges, identifying encrypted traffic solely based on packet byte-level features is significantlydifficult. To address this, we propose a universal packet-level encrypted traffic identification method, ComboPacket. This method utilizes convolutional neural networks to extract deep features of the current packet andits contextual information and employs spatial and channel attention mechanisms to select and locate effectivefeatures. Experimental data shows that Combo Packet can effectively distinguish between encrypted traffic servicecategories (e.g., File Transfer Protocol, FTP, and Peer-to-Peer, P2P) and encrypted traffic application categories (e.g.,BitTorrent and Skype). Validated on the ISCX VPN-non VPN dataset, it achieves classification accuracies of 97.0%and 97.1% for service and application categories, respectively. It also provides shorter training times and higherrecognition speeds. The performance and recognition capabilities of Combo Packet are significantly superior tothe existing classification methods mentioned.展开更多
基金supported in part by national science and technology major project of the ministry of science and technology of China No. 2012BAH45B01Fundamental Research Funds for the Central Universities No. 2014ZD03-03
文摘Network traffic is very important for testing network equipment, network services, and security products. A new method of generating traffic based on statistical packet-level characteristics is proposed. In every time unit, the generator determines the sent packets number, the type and size of every sent packet according to the statistical characteristics of the original traffic. Then every packet, in which the protocol headers of transport layer, network layer and ethernet layer are encapsulated, is sent via the responding network interface card in the time unit. The results in the experiment show that the correlation coefficients between the bandwidth, the packet number, packet size distribution, the fragment number of the generated network traffic and those of the original traffic are all more than 0.96. The generated traffic and original traffic are very highly related and similar.
基金the National Natural Science Foundation of China Youth Project(62302520).
文摘With the increasing proportion of encrypted traffic in cyberspace, the classification of encrypted traffic has becomea core key technology in network supervision. In recent years, many different solutions have emerged in this field.Most methods identify and classify traffic by extracting spatiotemporal characteristics of data flows or byte-levelfeatures of packets. However, due to changes in data transmission mediums, such as fiber optics and satellites,temporal features can exhibit significant variations due to changes in communication links and transmissionquality. Additionally, partial spatial features can change due to reasons like data reordering and retransmission.Faced with these challenges, identifying encrypted traffic solely based on packet byte-level features is significantlydifficult. To address this, we propose a universal packet-level encrypted traffic identification method, ComboPacket. This method utilizes convolutional neural networks to extract deep features of the current packet andits contextual information and employs spatial and channel attention mechanisms to select and locate effectivefeatures. Experimental data shows that Combo Packet can effectively distinguish between encrypted traffic servicecategories (e.g., File Transfer Protocol, FTP, and Peer-to-Peer, P2P) and encrypted traffic application categories (e.g.,BitTorrent and Skype). Validated on the ISCX VPN-non VPN dataset, it achieves classification accuracies of 97.0%and 97.1% for service and application categories, respectively. It also provides shorter training times and higherrecognition speeds. The performance and recognition capabilities of Combo Packet are significantly superior tothe existing classification methods mentioned.
基金国家高技术研究发展计划(863)(the National High- Tech Research and Development Plan of China under Grant No.2005AA1032)中国下一代互联网示范项目(the China Next Generation Internet(CNGI) under Grant No.CNGI-04-15-2A)
