Network Traffic Classifier With Convolutional and Recurrent Neural Networks for Internet of Things
Network Traffic Classifier With Convolutional and Recurrent Neural Networks for Internet of Things
复制标题
DOI：
10.1109/access.2017.2747560
复制
发表时间：
2017-01-01
期刊：
影响因子：
3.9
通讯作者：
Lloret, Jaime
中科院分区：
文献类型：
--
作者：
Lopez-Martin, Manuel;Carro, Belen;Lloret, Jaime
网络流量分类器（NTC）是当前网络监视系统的重要部分，其任务是推断通信流当前使用的网络服务（例如，HTTP和SIP）。该检测基于与通信流相关联的多个特征，例如，源端口和目的地端口以及每个分组传输的字节。NTC很重要，因为仅通过了解其网络服务（所需延迟、流量和可能的持续时间）就可以了解和预测有关当前网络流的许多信息。这对于物联网（IoT）网络的管理和监控尤其重要，NTC将有助于隔离异构设备和服务的流量和行为。在本文中，我们提出了一种基于深度学习模型组合的NTC新技术，可用于物联网流量。我们表明，与卷积神经网络（CNN）相结合的递归神经网络（RNN）提供了最佳的检测结果。CNN的自然域，即图像处理，已经以一种简单自然的方式扩展到NTC。我们表明，所提出的方法提供了更好的检测结果比其他算法，而不需要任何功能工程，这是通常在应用其他模型。对集成CNN和RNN的几种架构进行了完整的研究，包括所选特征的影响和用于训练的网络流的长度。
A network traffic classifier (NTC) is an important part of current network monitoring systems, being its task to infer the network service that is currently used by a communication flow (e.g., HTTP and SIP). The detection is based on a number of features associated with the communication flow, for example, source and destination ports and bytes transmitted per packet. NTC is important, because much information about a current network flow can be learned and anticipated just by knowing its network service (required latency, traffic volume, and possible duration). This is of particular interest for the management and monitoring of Internet of Things (IoT) networks, where NTC will help to segregate traffic and behavior of heterogeneous devices and services. In this paper, we present a new technique for NTC based on a combination of deep learning models that can be used for IoT traffic. We show that a recurrent neural network (RNN) combined with a convolutional neural network (CNN) provides best detection results. The natural domain for a CNN, which is image processing, has been extended to NTC in an easy and natural way. We show that the proposed method provides better detection results than alternative algorithms without requiring any feature engineering, which is usual when applying other models. A complete study is presented on several architectures that integrate a CNN and an RNN, including the impact of the features chosen and the length of the network flows used for training.