以網際網路流量進行網路服務分類預測之研究
Other Title
Using Internet Traffic Data for Predicting Network Services
Journal
網際網路技術學刊
Journal Volume
15
Journal Issue
1
Start Page
49
End Page
55
ISSN
1607-9264
Date Issued
2004-01
Author(s)
Abstract
網際網路應用的蓬勃發展，促成了各式網路服務的興起與廣泛使用。然而，除了一般正常使用的網路服務外，有許多的網路服務（如地下FTP站台、後門或跳板程式等）是無法由提供服務之伺服器所使用的埠號（port number）得知這項網路服務的類別。面對日益複雜的網路使用行為，若能正確地判別某些特定的網路服務，對於掌握網路使用狀況或於網路發生異常時，協助網路管理者及時偵測與排除問題應有莫大的助益。本研究利用Netflow網路流量資料，取樣七種不同網路服務的流量資料，以決策樹歸納學習技術（也就是C4.5），建立網路服務分類預測模式，並評估其分類預測之正確性。同時本研究以10個FTP伺服器之流量資料進行驗證，實證結果顯示所提出之網路服務分類技術可準確地判別各伺服器所提供之網路服務。
The proliferation of WWW has stimulated the development and adoption of many network services. Typically, a server installs a network service on a standard and well-known port. However, many services, including illegitimate FTP servers, backdoors and stepping stones, are installed on non-standard ports. Thus, it becomes extremely difficult to identify the type of a network service by looking at the port(s) the service uses. Conceivably, the identification of types of network services would facilitate network administrators oversee network usage as well as detect and resolve abnormal and malicious activities occurring in the network. In this study, we propose the use of a classification analysis technique (specifically, C4.5) for classifying types of network service, based on the Netflow network traffic data. Empirical evaluation results show that the proposed technique could reach a satisfactory predictive accuracy.
Subjects
網路流量分析
分類分析
資料探勘
網路服務分類預測
Netflow
Network Traffic Analysis
Classification Analysis
Data Mining
Network Service Classification
Type
journal article