Research on Network Traffic Classification Based on Adaptive Feature Selection and KNN

doi:10.3778/j.issn.1002-8331.2203-0062

Abstract

Abstract: With the continuous development of Internet technology, users can access the Internet through various applications on mobile phones or computers, but the abnormal traffic generated by some malicious programs has brought harm to network environment. Aiming at this problem, this paper proposes a network traffic classification model based on adaptive feature selection and improved KNN. The feature selection tendency is set up by introducing the mutual information method of cosine similarity to sort all the features of the data set, and then the optimal feature subset is selected according to the feature fitness of each feature subset, and then disassemble the multi-classification problem according to the interclass distance between various types of traffic, and finally uses the improved KNN algorithm to classify the traffic. The experimental results show that the proposed method has a significant improvement effect on the classification of similar types of traffic with uneven samples, and achieves a better classification performance overall.

Key words: traffic classification, KNN, feature fitness, distance between classes

摘要： 随着互联网技术的不断发展，用户可以在手机或电脑上通过各种应用程序访问互联网，但一些恶意程序产生的异常流量给网络环境带来了危害。针对这一问题，提出了一种基于自适应特征选择与改进KNN的网络流量分类模型。通过引进余弦相似度的互信息法设置了特征筛选倾向度对数据集所有特征进行排序，根据每个特征子集的特征适应度选出最优特征子集，根据各类流量之间的类间距离拆解多分类问题，采用改进KNN算法对流量进行分类。实验结果表明，所提方法在样本不均衡的相似类型流量分类问题上提升效果显著，且整体达到了较好的分类性能。

关键词: 流量分类, K近邻法, 特征适应度, 类间距离

LI Daoquan, LI Teng, LI Yuxiu. Research on Network Traffic Classification Based on Adaptive Feature Selection and KNN[J]. Computer Engineering and Applications, 2023, 59(12): 270-277.

李道全, 李腾, 李玉秀. 基于自适应特征选择与KNN的网络流量分类研究[J]. 计算机工程与应用, 2023, 59(12): 270-277.

References

[1] MUBARAK M，MCGLOHON N，MUSLEH M，et al.Evaluating quality of service traffic classes on the megafly network[C]//International Conference on High Performance Computing.Cham：Springer，2019：3-20.
[2] AHMAD Z，SHAHID KHAN A，WAI SHAING C，et al.Network intrusion detection system：a systematic study of machine learning and deep learning approaches[J].Transactions on Emerging Telecommunications Technologies，2021，32（1）：e4150.
[3] YUSOF A R，UDZIR N I，SELAMAT A，et al.Adaptive feature selection for denial of services（DoS） attack[C]//2017 IEEE Conference on Application，Information and Network Security（AINS），2017：81-84.
[4] 王灵矫，吕琮霞，郭华.SDN环境下基于支持向量机的DDoS攻击检测研究[J].云南大学学报（自然科学版），2021，43（1）：52-59.
WANG L J，LV Z X，GUO H.Research on DDoS attack detection based on support vector machine in SDN environment[J].Journal of Yunnan University（Natural Sciences Edition），2021，43（1）：52-59.
[5] 池亚平，莫崇维，杨垠坦，等.面向软件定义网络架构的入侵检测模型设计与实现[J].计算机应用，2020，40（1）：116-122.
CHI Y P，MO C W，YANG Y T，et al.Design and implementation of intrusion detection model for software-defined network architecture[J].Computer Applications，2020，40（1）：116-122.
[6] DA SILVA A S，WICKBOLDT J A，GRANVILLE L Z，et al.ATLANTIC：a framework for anomaly traffic detection，classification，and mitigation in SDN[C]//2016 IEEE/IFIP Network Operations and Management Symposium，2016：27-35.
[7] ALMSEIDIN M，ALZUBI M，KOVACS S，et al.Evaluation of machine learning algorithms for intrusion detection system[C]//2017 IEEE 15th International Symposium on Intelligent Systems and Informatics（SISY），2017：277-282.
[8] HOODA M，BABU J，VAMSI P S，et al.An improved intrusion detection system based on KDD dataset using feature ranking and data sampling[C]//2020 International Conference on Communication and Signal Processing（ICCSP），2020：1128-1132.
[9] OSANAIYE O，CAI H，CHOO K K R，et al.Ensemble-based multi-filter feature selection method for DDoS detection in cloud computing[J].EURASIP Journal on Wireless Communications and Networking，2016（1）：1-10.
[10] BOLON-CANEDO V，ALONSO-BETANZOS A.Ensembles for feature selection：a review and future trends[J].Information Fusion，2019，52：1-12.
[11] SHAFIQ M，YU X，BASHIR A K，et al.A machine learning approach for feature selection traffic classification using security analysis[J].The Journal of Supercomputing，2018，74（10）：4867-4892.
[12] TAVALLAEE M，BAGHERI E，LU W，et al.A detailed analysis of the KDD CUP 99 data set[C]//2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications，2009：1-6.
[13] RESENDE P A A，DRUMMOND A C.The hogzilla dataset[EB/OL].（2018）.https：//ids-hogzilla.org/dataset/.
[14] SHEN M，LIU Y，ZHU L，et al.Optimizing feature selection for efficient encrypted traffic classification：a systematic approach[J].IEEE Network，2020，34（4）：20-27.
[15] SHAFIQ M，YU X，LAGHARI A A，et al.Network traffic classification techniques and comparative analysis using machine learning algorithms[C]//2016 2nd IEEE International Conference on Computer and Communications（ICCC），2016：2451-2455.