МЕТОД КЛАСИФІКАЦІЇ ДОДАТКІВ ТРАФІКА КОМП'ЮТЕРНИХ МЕРЕЖ НА ОСНОВІ МАШИННОГО НАВЧАННЯ В УМОВАХ НЕВИЗНАЧЕНОСТІ

Abstract

The paper proposes a method for classifying applications of computer network traffic based on machine learning in conditions of uncertainty. Modern methods of classification of computer network traffic applications (such as the classification of transport layer protocols by port numbers) have significant shortcomings, which leads to and is the reason for the growth of research in the direction of classification of computer network traffic applications. The rapid growth in recent years of the types and number of transport layer network protocols increases the relevance of research in this area, the development of appropriate algorithms and methods for classifying applications of computer network traffic, which reduce computational complexity. At the present stage, the problem that needs to be urgently addressed is the classification of computer network traffic applications using appropriate protocols and encryption algorithms. A promising area of classification of computer network traffic applications is statistical methods, which are based on the analysis and identification of statistical characteristics of IP traffic. The most promising are the intellectual analysis of data flow, as well as machine learning technologies, which are currently widely used in related fields of science. The problem of research and training according to precedents is solved - classification of computer network traffic applications on the basis of pre-known set of attributes of their features, in order to improve the technical base of computer networks and theoretical base, while ensuring high performance and quality networks. example of using transport layer protocols (TCP / IP stack). The result of solving this problem is to assign the application, in accordance with the rules of the educational sample, to one of the outstanding classes, which are predetermined, which contains the relevant, but already classified applications. Statistical analysis and research of the attributes of Internet applications showed that the most important attributes associated with changes in the volume of Internet traffic flow are exponential. Fisher's criterion can be used to calculate anomalous changes in the amount of Internet traffic of applications to calculate averages. To classify Internet applications in data streaming mode, an algorithm for detecting the offset of the concept (drift) of data flow traffic is proposed for continuous data flow. Fisher's drift detector is based on the statistical characteristics of the attributes of Internet applications, analyzed using sliding windows that monitor changes in traffic current statistical characteristics of the attributes of applications.