|
| 摘要: |
| 引入统计理论中的卡方统计检验，提出一种通用的应用协议流量行为特征分析方法——ABSA (application behavior significance assessment)。该方法不针对特定的应用协议，旨在提出描述各应用协议间行为测度分布差异情况的统一量化标准，使其可进行比较，从而判断各协议的流量行为特征，并评估相应的显著程度。理论分析及实验结果表明，ABSA方法不仅可以为协议识别提供更丰富、更准确的特征信息，优化协议识别的结果，而且保证特征显著程度的评估与协议样本在总样本中所占的比例无关，并可用于 |
| 关键词: 网络行为 应用协议 流量分类 行为特征 卡方统计 报文抽样 |
| DOI： |
| 分类号: |
| 基金项目:Supported by the National Basic Research Program of China under Grant No.2009CB320505 (国家重点基础研究发展计划(973)); the National Key Technology R&D Program of China under Grant No.2008BAH37B04 (国家科技支撑计划) |
|
| Analyzing the Characteristics of Application Traffic Behavior Based on Chi-Square Statistics |
|
CHEN Liang, GONG Jian
|
| Abstract: |
| Based on the Chi-Square Statistics and Test, this paper proposes a method named ABSA (application behavior significance assessment) to analyze the traffic behavior characteristics of applications. The ABSA method does not focus on any certain applications; in contrast, it aims at providing a quantitative standard for describing the behavior distribution differences among applications, so that the traffic behavior characteristics and their corresponding significances can be determined. The theoretical analysis and experiments results show that 1) ABSA can present the information about characteristics more precisely and copiously to improve the accuracy of application identification; 2) the significance of characteristic is independent of its proportion in sample totals; 3) ABSA can keep the relative significance sequence of behavior characteristics unchanged in a packet sampling environment, which is often used by NetFlow and many other flow information collecting systems to simplify the characteristic re-selecting process when sampling ratio is changed. |
| Key words: network behavior application-level protocol traffic identification behavior characteristic chi- square statistics packet sampling |
