STI: A self-evolutive traffic identification system for unknown applications based on improved random forest

Artificial intelligence technology has proven potential and effective in traffic identification for network management and security. However, the accuracy of its identification is easily influenced by the massive unknown traffic. Given the fact of numerous unknown applications in real networks and e...

Ausführliche Beschreibung

Gespeichert in:
Bibliographische Detailangaben
Veröffentlicht in:Computer communications Jg. 219; S. 64 - 75
Hauptverfasser: Liang, Yulong, Wang, Fei, Chen, Shuhui, Chen, Beier, Bo, Yunjiao
Format: Journal Article
Sprache:Englisch
Veröffentlicht: Elsevier B.V 01.04.2024
Schlagworte:
Random forest
Sample similarity
Traffic identification
Unknown applications
Unsupervised algorithm
Unknown applications
Traffic identification
Random forest
Unsupervised algorithm
Sample similarity
ISSN:0140-3664
Online-Zugang:Volltext
Tags: Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
Beschreibung
Zusammenfassung:Artificial intelligence technology has proven potential and effective in traffic identification for network management and security. However, the accuracy of its identification is easily influenced by the massive unknown traffic. Given the fact of numerous unknown applications in real networks and even more as time goes by, a promising traffic identification system should have the ability to discover unknown applications and recognize their traffic. In this paper, an innovative and comprehensive traffic identification system, called STI, is proposed, which can achieve fulfilling high precision both on known and unknown traffic identification. More importantly, STI can self-evolve to identify incoming unknown applications and corresponding training samples based on a novel clustering process with minimal manual involvement. In addition, an improved random forest and a novel similarity calculation method are proposed and applied to STI to enhance the classification performance. Experiments on real network traffic demonstrate the core advantages of the proposed system.
ISSN:0140-3664
DOI:10.1016/j.comcom.2024.02.010