Traffic Identification Optimization of the Smallest Neighbor Method of AdaBoost-SVM

Transcription

1 raffc Idetfcato Optmzato of the Smallest Neghbor Method of AdaBoost-SVM Yuhua Zhu, Xao Ca Cha College of Busess Admstrato, Huaqao Uversty, Quazhou 36202, Fuja, Cha Abstract he tradtoal P2P traffc detfcato has the shortcomgs of low recogto rate ad msjudgmet rate s hgh. Cosderg the good classfcato ablty of AdaBoost algorthm ad geeralzato ablty of SVM mache learg, ths paper puts forward a combato algorthm of a P2P traffc detfcato, whch takes the SVM as the base of AdaBoost classfer ad uses the smallest eghbor method to classfy P2P traffc detfcato. ake the four kds of smulatos wth P2P traffc data as the research object, the smulato results show that the combato of AdaBoost ad SVM s better tha that of pure AdaBoost ad SVM algorthm classfcato performace ad classfcato accuracy, the average recogto rate s as hgh as 96.33% of combato algorthm. Key words: Support vector mache (SVM), the smallest eghbor method, Geeralzato ablty, Peer-to-peer etwork traffc. Itroducto Wth the rapd developmet of peer-to-peer etwork techology, P2P techology has bee wdely appled the streamg meda trasmsso, fle sharg, ad stat messagg, etc []. At preset, the P2P traffc has become the master of the Iteret traffc, the rapd growth of P2P traffc has caused serous burde to the etwork badwdth, tesfed the cogesto status of the etwork; meawhle, a large umber of P2P malcous traffc llegal coecto tesfes the badwdth cosumpto [2]. So the detfcato ad cotrol for P2P traffc becomes the key problems for etwork operators ad maagers have to solve. At preset, both at home ad abroad, P2P techology has bee famlar to us, the traffc detfcato theory research s also becomg more popular. he LASER algorthm was desged ad mplemeted by Park, such as usg the algorthm to extract the applcato layer cotet of logest commo subsequece to as detfcato of the applcato. Bttorret, ad realzed wth LmeWre applcato such as feature extracto, usg the extracted features to effectvely detfy, each traffc makes o-respose rates below 8.5% [3]. Rady et al proposed a fte state mache DPI algorthm has extesblty, solved the problem that storage space occuped large whe determg the fte state mache dow to detfy P2P traffc [4]. Aceto G to use about the - flter for each sesso search depth was studed. Research shows that each sesso traffc geerated the probablty of the frst packet reached 72%, ad the load of 32 bytes appeared before most of the character strg, ths shows that the begg of the stream are of great help for P2P traffc detfcato [5]. Xu ad others to a ode of the ascedg ad descedg traf f c for the s earch. ra of thought of ths method s that f we search out the characterstcs of the seres of the same, ad the detfy the P2P odes, amog them, they us e the s trg matchg algorthm for Rab algorthm [6]. Rsso et al. Research has show that there wll be mllos of CP sesso appears ggabt levels of the etwork. hs suggests that stad-aloe evromet has dffculty o the P2P traffc Idetfcato, makes the DPI (Deep Packet Idetfcato) techology caot be 38 Metallurgcal ad Mg Idustry

2 appled to hgh-speed etwork [7]. Este A studed the stablty of varous features of packets the etwork evromet. t s cocluded that the complex etwork evromet, the sze of the package s affected by the etwork chages the least sgfcat, ad they foud that for detfyg the most effectve packet hadshake s ofte A CP coecto whe the coecto s establshed after the frst packet [8]. hs paper combg AdaBoost ad SVM, ad put forward a kd of effcet P2P traffc detfcato techology, make the SVM as classfer of Ada- Boost, usg the smallest eghbor method to classfy P2P traffc detfcato, ad make a comparso valdato of combatoal algorthm ad P2P traffc detfcato of AdaBoost ad SVM. 2. Support Vector Mache SVM s a kd of mache learg method based o statstcs whch s proposed by Vapk, mostly used to solve the Small sample patter classfcato 2 m φ ( ) = = ( ) 2 2 It s trasformed to dualzato problem further more [7]: m ( α) = α Q Aα b α 2 st. α 0 ( =,2,..., ) y α = 0 (4) problems [9]. If lear separable sample set, ) ( X y ( =, 2,..., ; X R d, y {,} ). he dscrmato fucto s ormal patter of g( X)= W X bdmeso s lear s [3-5]: g( X)= W X b () he Classfcato surface equato deduced through formula () s show as formula (2): W X b =0 (2) he formula (2) s carred o the ormalzato of dscrmat fucto, factor W ad b s adjust, whch makes the two kds of all samples ca meet g( X ),a ths tme the class terval equals to 2/ W, thus Maxmum terval problem s trasformed to seek the mmum of W. hus the Optmal Hyper Plae problem s trasformed to the optmzato problem [0]: W W W W st. y[( W X ) b] 0 ( =,2,..., ) (3) the trag sample data set s adjusted dyamc through the searchg of avalable trag sample. he combato algorthm process s show as below: If the orgal trag sample set, whch x, y mea the trag pot ad type separately, meas the trag sample s umber. w () meas every x x ad every weght teratve retured, meas I the formula (4): α = ( α, α2,..., α ), the sze of every trag subset, the process of combatoal algorthm AdaBoost ad SVM are show as b = (,,...,), y = ( y, y2,..., y ), Aj = yy j ( x xj ) below [7-0]: he optmal classfcato fucto ca be deduced w ( ) = ( =,2,3,..., ) Step: the weght through formula (4) show as formula (5): s talzed, the trag tme s set as t = 0 ; ( ) = sg{ f x α y( X X) b } Step2:accordg to the curret dstrbuto of (5) = weght w (), the umber of samples s choose 3. AdaBoost-SVM Smallest Neghbor Method from the orgal trag sample, the oe sample he SVM s used as the base classfer of the subset χ s completed, the sze of subset s ; A daboos t algorthm, the S malles t Neghbor Step3: all the sample ut of trag subset χ s Method s used to calculate the dstace of vector ad used to search the support vector; the trag set order to realze the classfcato, If st. α 0 ( =, 2,..., ) m W( α) = αα yy( X X ) α j j j 2 α = 0, j= = y = (6) he above formula s solved ad get the soluto - vector, f α 0, the X s the X = α y C = α = α C ( x, y) SV y= y= searchg support vector. Set t = t, the amout of, whch. he the geerated base classfer s carred o the teratve other sample pots ad the dstace betwee X ad - computato, f t > max ge, the swtch to Step6. X sde the sample set χ are separately calculated, Step4:the foud support vector s used to costruct the sze of dstace s used to carry o the category the postve example X = α y ad egatve example Step5:all the sample data of the orgal trag judgemet. C ( x, y) SV sample s carred o the classfcato, the weghted Metallurgcal ad Mg Idustry 39

3 error rate s calculated accordg to formula (7): = = w () (7) I the formula (7), meas wrog classfed uts. he adjustmet rules of sample weght: f the sample s wrog classfed, the the sample weght reduce; otherwse, the weght crease. Step 6:oe sample s radomly choose from the orgal sample data set accordg to the curret weght dstrbuto W ( α), f ths sample s ot the trag sample ad also wrog classfed by the curret base classfer, the ths sample s added to the curret trag sample subset, ad the mmum weght sample sde the trag subset s deleted, the swtch to Step3;otherwse, swtch to Step 6 Step 7:weght combato t classfer; s H( x) = sg( l( ) Hs ( x)) t s= s (8) 4. P2P raffc Recogto Based o AdaBoost ad SVM P2P raffc Recogto process of AdaBoost ad SVM, cludg the data collecto, data feature extracto, trag sample ad traffc recogto. I order to verfy the effect of P2P raffc Recogto. he trag tme, recogzed rate performaces s used to calculate the recogto effect. O the base of refereces lterature at home ad abroad, statstcal data packets use 30s as a tme slce. he total umber of packets, upw ard traff c rate, average packet legth, CP traffc ad he umber of coectos ad the rato of dfferet IP umber fve traffc characterstcs are choose as the put data. he Wreshark software s used to cut out each 300 umber P2P traffc sample of Btorret, emule, PPLve, PPStrea, 50 umber sample of each kd s choose as the trag subject of the combatoal algorthm, others are used to test the performace of combatoal algorthm. the MALAB s used as the test platform, parameter of the SVM are: C = 00, Sgma = 0.3 he recogto results of the P2P traffc based o AdaBoost ad SVM are show as the Fg.: (a) before the combatoal algorthm (b) after the combatoal algorthm Fgure. he comparso of before ad after P2P traffc recogto based o AdaBoost ad SVM It ca be see from the Fg. that, the comparso of before ad after P2P traffc recogto based o AdaBoost ad SVM, the results are very obvous. Before the trag, the recogto s very hard to fd ad dsorder; after the trag, the recogto s very hgh. I the Fg.,, 2, 3, 4 separately mea the P2P traffc of Btorret, emule,pplve,ppstream. he umber of sample s totally 600, -50 group s Btorret s traffc, group s emule s traffc, group s PPLve s traffc, group s PPStream s traffc. I order to test the valdty ad relablty of the combato algorthm, 600 groups data are tested, the test results are show as Fg.2, the algorthm precso s really hgher, but because of the smlarty betwee PPLve ad PPStream, parts traffcs may be wrog recogzed. Fgure 2. est results of combato algorthm 40 Metallurgcal ad Mg Idustry

4 I order to test the advatages of AdaBoost ad S V M combato algorthm dog P 2P tr aff c recogto, t s compared wth the SVM ad AdaBoost algorthm, the recogto results are show as Fg.3, the P2P traffc recogto results of AdaBoost algorthm are show as the Fg.4. (a)trag results of SVM (b)test results of SVM Fgure 3. he P2P traffc recogto results of SVM (a) AdaBoost before the trag (b) AdaBoost after the trag (c) test results of AdaBoost Fgure 4. he P2P traffc recogto results of AdaBoost P2P traffc recogto results rate of AdaBoost- SVM combato algorthm, SVM ad AdaBoost algorthm are show as ab.. From ab., Fg.5 ad the P2P traffc recogto results of these three algorthms, t ca be kow that the proposed combato algorthm s better tha the AdaBoost, but AdaBoost s better tha SVM, the combato algorthm s recogto wrog recogzed rate are the opmal, thus t s superorty ad relablty s verfed. Metallurgcal ad Mg Idustry 4

5 he P2P traffc recogto of combato algorthm, SVM ad AdaBoost algorthms are carred o 0 tmes, ther recogto rates cooperato s show as the Fg.5. t ca be see from the Fg.5 that the combato algorthm s recogto rate reached up to 96.33%, whch s far more tha SVM ad Ada- Boost algorthm. able. P2P traffc recogto results rate of AdaBoost- SVM combato algorthm, SVM ad AdaBoost algorthm(tme(s)) method tme Bt emule PPL PPS ombato algorthm % 99.35% 96.2% 99.56% SVM % 90.65% 58.33% 76.74% AdaBoost % 96.2% 98.52% 90.43% Fgure 5. he recogto rate of dfferet rug tmes 5. Cocluso Amg at the low recogto rate ad hgh wrog recogto rate of the tradtoal P2P traffc recogto techology, ths paper proposed the P2P traffc detfcato optmzato of the smallest eghbor method of AdaBoost-SVM, ad the effectveess of ths patte s proved by expermet smulato. he mature system of P2P traffc recogto s detfcato, motorg ad cotrol s ot competed, such comprehesve qualty system ca be appled to the etwork supervso work, helpg the etwork operators to motor P2P traffc, research ad developmet of ths kd of system ca be used as the ext step research drecto. Refereces. Che H, Hu Z, Ye Z (2009) Research of P2P raffc detfcato based o BP eural etwork. Proc of the st It Symp o Computer Network ad Multmeda echology, p.p Yag A, Jag S, Deg H, (20)A P2P etwork traffc classfcato method usg SVM. Proc of the 9th It Cof o Youg Computer Scetsts, p.p Park B C, Wo Y J, Km M S, et al. (202) owards automated applcato sgature geerato for traffc detfcato. Proc. of Network Operatos ad Maagemet Symposum, p.p Smth R, Esta C, Jha S, et al. (200) Deflatg the bg bag: fast ad scalable deep packet specto wth exteded fte automata. ACM SIGCOMM Computer Commucato Revew, p.p Aceto G, Daott A, Doato W, et al. (202) PortLoad: takg the best of two worlds traffc classfcato. Proc. of IEEE Coferece o Computer Commucatos Workshops, p.p Xu K, Zhag M, Ye M, et al. (20) Idetfy P 2P tr aff c by s pectg data tras fer behavor. Computer Commucatos, 33, p.p Rsso F, Bald M, Morad O, et al. (202) Lghtweght, payload-based traffc classfcato: A expermetal evaluato. Proc. of IEEE Iteratoal Coferece o Commucatos, p.p Este A, Grgol F, Salgarell L. (204) O the stablty of the formato carred by traffc traffc features at the packet level. ACM SIGCOMM Computer Commucato Revew, 39, p.p Fu Zhoglag, Zhao Xag-hu, Mao Qg, Yao Yu et al. ( 200) AdaBoost algorthm promoto-a set of tegrated learg algorthm. Joural of Schua Uversty (Egeerg Scece), 6, p.p Zhuag Ya, Ba Zhel, Xu Yufeg (20) Research o Parameters of Support Vector Mache Based o At coloy algorthm. Computer Smulato, 28(5), p.p Metallurgcal ad Mg Idustry