宽带接入网流量识别关键技术研究
|
摘要
当前互联网发展异常迅速,物联网、云计算等相关新技术不断涌现,宽带接入已成国际发展总趋势之一。随着网络带宽的增加以及业务类型的多样化,网络流量日益具有复杂性和动态性。及时准确地识别网络流量对于流量工程、QoS以及网络安全管理等有重要的现实意义,网络流量识别已成为互联网研究的热点之一。
接入网流量具有高速性、动态性、复杂性、连续性和数据量大、存在概念漂移、不同类型数据流分布不平均等特点,网络数据流识别方法需要做到在有限存储空间和时间内快速识别并能适应数据流概念漂移等情况。传统和现有的流量识别方法大多是基于静态数据集的分类识别方法,很难适应高速、在线、宽带接入的流量识别。
本文针对宽带接入网流量识别问题进行了重点研究,提出了三种流量在线识别算法及相应识别方案和一种新的基于不确定性证据推理的决策融合流量识别原型体系。主要创新点包括以下几点：
1.提出了自适应分级滑动窗决策树的分类算法AGSW-DT。
该算法基于Hoeffding决策树,根据节点信息增益率检测概念漂移,动态调整不同概念滑动窗口及训练数据样本集,实现了对不同速率概念漂移的自适应检测和决策树更新。通过实验并与C4.5、CVFDT分类结果对比,显示AGSW-DT算法克服了由于概念偏态分布造成概念不完全更新的问题。在有效提高概念漂移检测效率的同时,可以获得更加均衡的不同应用类型分类准确度,适用于网络流量工程应用领域对已知应用类型流量进行带宽控制和管理等需求。
2.提出了基于密度在线聚类OL-DBSCAN算法及识别方案。
该算法采用数据流的若干初始数据包作为子流,满足了对数据流的早期识别要求。通过引入Q值解决了聚类算法存在的参数选择的难题。基于OL-DBSCAN在线分类方案结合了自适应在线聚类算法、DPI检测机制,实验结果表明了该方案具有识别加密数据流,提取新应用类型特征的能力,能适应数据流特征随时间变化。适用于网络安全管理方面的应用,可以有效提取未知应用类型的特征信息提供给管理者做进一步分析和处理。
3.提出了基于传输层连接拓扑模式的流量分类算法TCTP。
该算法利用了不同应用类型在传输层表现出的连接特征,通过提取典型应用类型的连接模式特征信息,生成应用类型和网格的映射关系以及应用类型池,进而实现了实时流量识别。该方法不依赖数据流时间统计信息,没有分类和聚类算法对时间统计特性敏感的问题,具有较高的实时性和可靠性,对于分类方法和聚类方法具有良好的补充识别作用。
4.提出了基于证据推理的多分类器决策融合识别原型体系。
由于每种流量识别算法各有优缺点,为有效利用多个不同算法的识别结果,需要实现决策信息融合,提出了流量识别原型系统基于证据推理的不确定性决策融合算法,采用最大信任函数融合,实现了多分类器的决策信息融合。实验结果显示了该体系能大幅提高分类准确率,同时降低分类的拒识率和错误率,综合识别结果表明在各指标上都要优于单个分类器,充分发挥了各分类器的优势。
Nowadays the Internet has developed dramatically, many new technologies, such as the Internet of things and cloud computing, are emerging constantly, and broadband access has already become one of the international development trends. The network traffic has become increasingly complex and dynamic with the increase of network bandwidth and diversification of application types. Accurate and timely identification of network traffic according to application types plays important roles in many areas, such as traffic engineering, QoS and network security management. Therefore traffic identification has been one of the hottest topics in the Internet research field.
Traffic of access network have characteristics of high-speed, dynamic, complexity, continuity and large amount of data, concept drift, unbalance distribution among different application types. So traffic identification methods should achieve rapid response and adapt to the concept drifting in the limited storage space and time. The traditional and existing traffic identification methods based on static data set are difficult to adapt to high speed traffic identification in broadband access network.
Aiming at the access network traffic identification, we conduct a series of studies, including three traffic identification algorithms and a decision fusion prototype system based on uncertainty evidence reasoning. The main contributions of this thesis are as follow in detail:
1. We propose a classification algorithm, named as Adaptive Grading Slide Window Decision Tree (AGSW-DT).
AGSW-DT algorithm is based on Hoeffding decision tree. It realizes the different rate adaptive detection of concept and decision tree update by detecting concept drifting according to the Information Gain Ratio of nodes, adjusting concept slide windows and training example set dynamically in accordance with the detection results. Comparing to the experiment results of C4.5and CVFDT, AGSW-DT algorithm overcomes the problem of concept updating incompletely caused by the skewing distribution of data concept. The proposed algorithm can improve the efficiency of concept drifting detection and can obtain more balanced classification accuracy among different application types. The algorithm can apply to the network traffic engineering and bandwidth management fields in terms of known application types.
2. Put forward online clustering algorithm OL-DBSCAN based on density and traffic identification scheme.
OL-DBSCAN algorithm clusters traffic flows based on sub-flow statistical features instead of full flows for the demands of early traffic identification, and solves the parameter selection problem of clustering algorithm by introducing the Q value. The proposed scheme based on the OL-DBSCAN combines with DPI method. The experimental results show that the scheme is capable of identifying the encrypted traffic, extracting characteristics of new application types, and can adapt to the traffic characteristics change over time. The scheme can apply to network security management, which extracts characteristics of unknown application types for managers to make further analysis and processing.
3. Propose Transport-layer Connection Topological Pattern (TCTP) traffic classification algorithm.
TCTP algorithm makes use of the characteristics of different application types showed in the transport layer. Firstly, the algorithm extracts typical patterns of application types to generate the mapping between application types and grid of clustering. And then creates service type pools of nodes, which can be verified by DPI technique. Finally, the traffic would be classified according to the mapping and service type pools. This algorithm is not depends on traffic time statistical information, so it has not time sensitive issues of statistical features as classification and clustering algorithm, and has the high real-time and reliability. TCTP algorithm is a good complementary for classification and clustering methods.
4. Propose a multiple classifier decision fusion prototype based on uncertainty evidence reasoning theory.
Each traffic identification algorithm has its own advantages. To utilize different algorithms results effectively, the decision information fusion is need to implement. We propose a decision fusion framework based on uncertainty evidence reasoning, and experiments illustrate that the decision fusion can improve the precision of traffic classification substantially, and reduce the rejected rate and the error rate simultaneously. Comprehensive identification results show that the decision fusion prototype is superior to each single classifier in many performance indexes, and gives play to the advantages of each classifier.
接入网流量具有高速性、动态性、复杂性、连续性和数据量大、存在概念漂移、不同类型数据流分布不平均等特点,网络数据流识别方法需要做到在有限存储空间和时间内快速识别并能适应数据流概念漂移等情况。传统和现有的流量识别方法大多是基于静态数据集的分类识别方法,很难适应高速、在线、宽带接入的流量识别。
本文针对宽带接入网流量识别问题进行了重点研究,提出了三种流量在线识别算法及相应识别方案和一种新的基于不确定性证据推理的决策融合流量识别原型体系。主要创新点包括以下几点：
1.提出了自适应分级滑动窗决策树的分类算法AGSW-DT。
该算法基于Hoeffding决策树,根据节点信息增益率检测概念漂移,动态调整不同概念滑动窗口及训练数据样本集,实现了对不同速率概念漂移的自适应检测和决策树更新。通过实验并与C4.5、CVFDT分类结果对比,显示AGSW-DT算法克服了由于概念偏态分布造成概念不完全更新的问题。在有效提高概念漂移检测效率的同时,可以获得更加均衡的不同应用类型分类准确度,适用于网络流量工程应用领域对已知应用类型流量进行带宽控制和管理等需求。
2.提出了基于密度在线聚类OL-DBSCAN算法及识别方案。
该算法采用数据流的若干初始数据包作为子流,满足了对数据流的早期识别要求。通过引入Q值解决了聚类算法存在的参数选择的难题。基于OL-DBSCAN在线分类方案结合了自适应在线聚类算法、DPI检测机制,实验结果表明了该方案具有识别加密数据流,提取新应用类型特征的能力,能适应数据流特征随时间变化。适用于网络安全管理方面的应用,可以有效提取未知应用类型的特征信息提供给管理者做进一步分析和处理。
3.提出了基于传输层连接拓扑模式的流量分类算法TCTP。
该算法利用了不同应用类型在传输层表现出的连接特征,通过提取典型应用类型的连接模式特征信息,生成应用类型和网格的映射关系以及应用类型池,进而实现了实时流量识别。该方法不依赖数据流时间统计信息,没有分类和聚类算法对时间统计特性敏感的问题,具有较高的实时性和可靠性,对于分类方法和聚类方法具有良好的补充识别作用。
4.提出了基于证据推理的多分类器决策融合识别原型体系。
由于每种流量识别算法各有优缺点,为有效利用多个不同算法的识别结果,需要实现决策信息融合,提出了流量识别原型系统基于证据推理的不确定性决策融合算法,采用最大信任函数融合,实现了多分类器的决策信息融合。实验结果显示了该体系能大幅提高分类准确率,同时降低分类的拒识率和错误率,综合识别结果表明在各指标上都要优于单个分类器,充分发挥了各分类器的优势。
Nowadays the Internet has developed dramatically, many new technologies, such as the Internet of things and cloud computing, are emerging constantly, and broadband access has already become one of the international development trends. The network traffic has become increasingly complex and dynamic with the increase of network bandwidth and diversification of application types. Accurate and timely identification of network traffic according to application types plays important roles in many areas, such as traffic engineering, QoS and network security management. Therefore traffic identification has been one of the hottest topics in the Internet research field.
Traffic of access network have characteristics of high-speed, dynamic, complexity, continuity and large amount of data, concept drift, unbalance distribution among different application types. So traffic identification methods should achieve rapid response and adapt to the concept drifting in the limited storage space and time. The traditional and existing traffic identification methods based on static data set are difficult to adapt to high speed traffic identification in broadband access network.
Aiming at the access network traffic identification, we conduct a series of studies, including three traffic identification algorithms and a decision fusion prototype system based on uncertainty evidence reasoning. The main contributions of this thesis are as follow in detail:
1. We propose a classification algorithm, named as Adaptive Grading Slide Window Decision Tree (AGSW-DT).
AGSW-DT algorithm is based on Hoeffding decision tree. It realizes the different rate adaptive detection of concept and decision tree update by detecting concept drifting according to the Information Gain Ratio of nodes, adjusting concept slide windows and training example set dynamically in accordance with the detection results. Comparing to the experiment results of C4.5and CVFDT, AGSW-DT algorithm overcomes the problem of concept updating incompletely caused by the skewing distribution of data concept. The proposed algorithm can improve the efficiency of concept drifting detection and can obtain more balanced classification accuracy among different application types. The algorithm can apply to the network traffic engineering and bandwidth management fields in terms of known application types.
2. Put forward online clustering algorithm OL-DBSCAN based on density and traffic identification scheme.
OL-DBSCAN algorithm clusters traffic flows based on sub-flow statistical features instead of full flows for the demands of early traffic identification, and solves the parameter selection problem of clustering algorithm by introducing the Q value. The proposed scheme based on the OL-DBSCAN combines with DPI method. The experimental results show that the scheme is capable of identifying the encrypted traffic, extracting characteristics of new application types, and can adapt to the traffic characteristics change over time. The scheme can apply to network security management, which extracts characteristics of unknown application types for managers to make further analysis and processing.
3. Propose Transport-layer Connection Topological Pattern (TCTP) traffic classification algorithm.
TCTP algorithm makes use of the characteristics of different application types showed in the transport layer. Firstly, the algorithm extracts typical patterns of application types to generate the mapping between application types and grid of clustering. And then creates service type pools of nodes, which can be verified by DPI technique. Finally, the traffic would be classified according to the mapping and service type pools. This algorithm is not depends on traffic time statistical information, so it has not time sensitive issues of statistical features as classification and clustering algorithm, and has the high real-time and reliability. TCTP algorithm is a good complementary for classification and clustering methods.
4. Propose a multiple classifier decision fusion prototype based on uncertainty evidence reasoning theory.
Each traffic identification algorithm has its own advantages. To utilize different algorithms results effectively, the decision information fusion is need to implement. We propose a decision fusion framework based on uncertainty evidence reasoning, and experiments illustrate that the decision fusion can improve the precision of traffic classification substantially, and reduce the rejected rate and the error rate simultaneously. Comprehensive identification results show that the decision fusion prototype is superior to each single classifier in many performance indexes, and gives play to the advantages of each classifier.
引文
[1]Cerf V, Kahn R. A Protocol for Packet Network Intercommunication. IEEE Transactions on Communications,1974,22(5):637-648.
[2]Azuri C. Ipoque Internet Study 2007:P2P File Sharing Still Dominates the Worldwide Internet. http://www.ipoque.com.
[3]Internet Assigned Numbers Authority, http://www.iana.org.2010.
[4]CAIDA. Coralreef. http://www.caida.org/tools/measurement/coralreef/ status.xm1.2010.
[5]Sen S, Wang J. Analyzing Peer-to-Peer Traffic Across Large Networks. IEEE/ACM Transactions on Networking,2004,12(2):219-232.
[6]Aiello W, Kalmanek C, McDaniel P, et al. Analysis of Communities of Interest in Data Networks.BERLIN:SPRINGER-VERLAG BERLIN, 2005:83-96.
[7]Karagiannis T, Papagiannaki K, Faloutsos M. Blinc:Multilevel Traffic Classification in the Dark. COMPUTER COMMUNICATION REVIEW, 2005,35(4):229-240.
[8]Xu K, Zhang Z L, Bhattacharyya S. Internet Traffic Behavior Profiling for Network Security Monitoring. IEEE-ACM TRANSACTIONS ON NETWORKING,2008,16(6):1241-1252.
[9]Constantinou F, Mavrommatis P. Identifying Known and Unknown Peer-to-Peer Traffic. In Proceedings of Fifth IEEE International Symposium on Network Computing and Applications,NEW YORK,2006.93-100.
[10]Agrawal A, Kumar K R P, Athithan G. Sip/Rtp Session Analysis and Tracking for Voip Logging.In 16th IEEE International Conference on Networks,,2008.1-5.
[11]陈贞翔.具有规模适应性的互联网流量识别方法研究[学位论文].山东大学,2008.
[12]Sen S, Spatscheck O, Wang D. Accurate, Scalable in-Network Identification of P2P Traffic Using Application Signatures.In Proceedings of the 13th conference on WWW, New York, USA,2004.512-521.
[13]Chen Z X, Yang B, Chen Y H, et al. Online Hybrid Traffic Classifier for Peer-to-Peer Systems Based On Network Processors. Applied Soft Computing,2009,9(2):685-694.
[14]L7-Filter. http://sourceforge.net/projects/17-filter/.2009.
[15]Cisco. Cisco Ios Technologies. http://www.cisco.com/.
[16]Gong Y. Identifying P2P Users Using Traffic Analysis. http://www.securityfocus.com/infocus/1843.2009.
[17]Bonfiglio D, Mellia M, Meo M, et al. Detailed Analysis of Skype Traffic. IEEE TRANSACTIONS ON MULTIMEDIA,2009,11(1):117-127.
[18]Callado A, Kamienski C, Szabo G, et al. A Survey On Internet Traffic Identification. IEEE COMMUNICATIONS SURVEYS AND TUTORIALS, 2009,11(3):37-52.
[19]Frost V S, Melamed B. Traffic Modeling for Telecommunications Networks. IEEE Communications Magazine,1994,32(3):70-81.
[20]Leland W E, Willinger W, Taqqu M S, et al. On the Self-Similar Nature of Ethernet Traffic (Extended Version). IEEE/ACM Trans.On Networking, 1994,2(1):1-15.
[21]Paxson V, Floyd S. Wide Area Traffic:The Failure of Poisson Modeling. IEEE/ACM Transactions on Networking,1995,3(3):226-244.
[22]Tsybakov B, Georganas N D. Self-Similar Processes in Communications Networks. IEEE Trans. on Information Theory,1998,44(5):1713-1725.
[23]Riedi R H, Crouse M S, Ribeiro V J, et al. A Multifractal Wavelet Model with Application to Network Traffic. Information Theory, IEEE Transactions on,1999,45(3):992-1018.
[24]Balamash A, Krunz M. A Parsimonious Multifractal Model for Www Traffic. Web Engineering and Peer to Peer Computing,2002,2376:1-14.
[25]Erramilli A, Roughan M, Veitch D, et al. Self-Similar Traffic and Network Dynamics. Proceedings of the IEEE,2002,90(5):800-819.
[26]杨谈,崔毅东,金跃辉等.基于混沌理论的网络流量性能评估.电子与信息学报,2009(12)：2993-2996.
[27]Willinger W, Taqqu M S, Sherman R, et al. Self-Similarity through High-Variability:Statistical Analysis of Ethernet Lan Traffic at the Source Level. IEEE/ACM Transactions on Networking,1997,5(1):71-86.
[28]Clark G A, Sengupta S K, Aimonetti W D, et al. Multispectral Image Feature Selection for Land Mine Detection. Geoscience and Remote Sensing, IEEE Transactions on,2000,38(1):304-311.
[29]Mandelbrot B B. The Fractal Geometry of Nature. New York:Freeman, 1983
[30]Taqqu M, Teverovsky V, Willinger W. Estimators for Long-Range Dependence:An Empirical Study. Fractals,1995,3:785-798.
[31]Norros I. A Storage Model with Self-Similar Input. Queueing System, 1994,16:387-396.
[32]Mandelbrot B B. Limit Lognormal Multifractal Measures. In Frontiers of Physics:Landau Memorial Conference,1989.309-340.
[33]Zhang H F, Shu Y T. Estimation of Hurst Parameter by Varianee--Time Plots. In IEEE Pacific Rim Conference on Communications, Computers and Signal Processing,1997.883-886.
[34]Lau W, Erramilli A, Wang J L, et al. Self-Similar Traffic Parameter Estimation:A Semi-Parametric Periodogram-Based Algorithm.In IEEE Global Telecommunications Conference,1995.2225-2231.
[35]Abry P, Veitch D. Wavelet Analysis of Long-Range-Dependent Traffic. IEEE Transactions on Information Theory,1998,44(1):2-15.
[36]Feldmann A, Gilbert A C, Willinger W. Data Networks as Cascades: Investigating the Multifractal Nature of Internet Wan Traffic. ACM SIGCOMM Computer Communication Review,1998,28(4):42-55.
[37]Veres A, Boda M. The Chaotic Nature of Tcp Congestion Control. In IEEE INFOCOM,Tel Aviv,2000
[38]Zhang Z, Ribeiro V J, Moon S, et al. Small-Time Scaling Behaviors of Internet Backbone Traffic:An Empirical Study. IEEE INFOCOM, 2003,3:1826-1836.
[39]The Cooperative Association for Internet Data Analysis(Caida). http://www.caida.org/data/overview/.2010.
[40]林青家.基于小波的网络流量的特性刻画与模型建立[学位论文].山东大学,2007.
[41]Hohn N, Veitch D, Abry P. Does Fractal Scaling at the Ip Level Depend On Tcp Flow Arrival Processes?In Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment, Marseille, France,2002.63-68.
[42]Williams N, Zander S, Armitage G. A Preliminary Performance Comparison of Five Machine Learning Algorithms for Practical Ip Traffic Flow Classification. SIGCOMM Comput. Commun. Rev.,2006,36(5):5-16.
[43]Langley P. Elements of Machine Learning.Morgan Kaufmann,1996.
[44]Mitchell M. Machine Learning.New York:McGraw-Hill,1997.
[45]Alpaydin E. Introduction to Machine Learning.MIT Press,2004.
[46]Nguyen T, Armitage G. Training On Multiple Sub-Flows to Optimise the Use of Machine Learning Classifiers in Real-World Ip Networks.NEW YORK:IEEE,2006:369-376.
[47]Moore A W, Papagiannaki K. Toward the Accurate Identification of Network Applications.DOVROLIS C. Passive and Active Network Measurement. BERLIN:SPRINGER-VERLAG BERLIN,2005:41-54.
[48]Bernaille L, Teixeira R. Implementation Issues of Early Application Identification.FDIDA S, SUGIURA K. Sustainable Internet. BERLIN: SPRINGER-VERLAG BERLIN,2007:156-166.
[49]Erman J, Mahanti A, Arlitt M, et al. Offline/Realtime Traffic Classification Using Semi-Supervised Learning. PERFORMANCE EVALUATION, 2007,64(9-12):1194-1213.
[50]黄晓璐.网络流量的半马尔柯夫模型[学位论文].中国科学院研究生院(计算技术研究所),2006.
[51]Quinlan J R. C4.5:Programs for Machine Learning.San Mateo:Morgan Kaufmann,1993.
[52]马永立,钱宗珏,寿国础等.机器学习用于网络流量识别.北京邮电大学学报,2009(1)：65-68.
[53]林平.网络流量的离线分析[学位论文].北京邮电大学,2010.
[54]Mehta M, Agrawal R, Rissanen J. Sliq:A Fast Scalable Classifier for Data Mining.In proceedings of 5th International Conference on Extending Database Technology, Avignon, France,1996.18-32.
[55]Shafer J, Agrawal R, Mehta M. Sprint:A Fast Scalable Parallel Classifier for Data. In Proceedings of International Conference on Very Large Data Bases (VLDB's96), Bombay,India,1996.544-555.
[56]徐鹏,林森.基于C4.5决策树的流量分类方法.软件学报,2009(10)：2692-2704.
[57]Moore A W, Zuev D. Internet Traffic Classification Using Bayesian Analysis Techniques.In Proceedings of the 2005 ACM SIGMETRICS international conference on Measurement and modeling of computer systems, Banff, Alberta, Canada,2005.50-60.
[58]Widmer G, Kubat M. Learning in the Presence of Concept Drift and Hidden Contexts. Maehine Learning,1996,23(1):10-69.
[59]Domingos P, Hulten G. Mining High-Speed Data Streams.In Proceedings of the sixth ACM SIGKDD international conference on Knowledge discovery and data mining, Boston, Massachusetts, United States,2000.71-80.
[60]Last M. Online Classification of Nonstationary Data Streams. Intelligent Data Analysis,2002,6(2):129-147.
[61]Hulten G, Spencer L, Domingos P. Mining Time-Changing Data Streams.In Proceedings of the seventh ACM SIGKDD, San Francisco, California, 2001.97-106.
[62]王永利.数据流概要与数据流分析若干关键问题研究[学位论文].东南大学,2006.
[63]Dash M, Liu H. Feature Selection for Classification. Intelligent Data Analysis,1997,1(3):131-156.
[64]Doak J. an Evaluation of Feature Selection Methods and their Application to Computer Security.Technical Report, Univ. Of California at Davis, Dept. Computer Science[R].1992.
[65]Liu H, Motoda H. Chapter 1 "Less is More," Feature Extraction,Construction and Selection:A Data Mining Perspective.second printing.2001:3-12.
[66]Liu H, Yu L. Toward Integrating Feature Selection Algorithms for Classification and Clustering. IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING,2005,17(4):491-502.
[67]Dash M, Choi K, Scheuermann P, et al. Feature Selection for Clustering-A Filter Solution. In Data Mining,2002. ICDM 2002. Proceedings.2002 IEEE International Conference on,2002.115-122.
[68]Lipo W, Nina Z, Feng C. A General Wrapper Approach to Selection of Class-Dependent Features. Neural Networks, IEEE Transactions on, 2008,19(7):1267-1278.
[69]Hruschka E R, Hruschka E R, Covoes T F, et al. Feature Selection for Clustering Problems:A Hybrid Algorithm that Iterates Between K-Means and a Bayesian Filter. In Proceedings of 5th International Conference on Hybrid Intelligent Systems,LOS ALAMITOS,2005.405-410.
[70]Dai L, Yun X, Xiao J. Optimizing Traffic Classification Using Hybrid Feature Selection. In Proceedings of The Ninth International Conference on Web-Age Information Management,Zhangjiajie Hunan,2008.520-525.
[71]Domingos P, Hulten G. Mining High-Speed Data Streams.In Proceedings of the seventh ACM SIGKDD international conference on Knowledge discovery and data mining,2000.71-80.
[72]Deng Y, Liu J. Feature Selection Based On Mutual Information for Language Recognition. In PROCEEDINGS OF THE 2ND INTERNATIONAL CONGRESS ON IMAGE AND SIGNAL PROCESSING,NEW YORK,2009.4319-4322.
[73]Chou T, Yen K K, Luo J, et al. Correlation-Based Feature Selection for Intrusion Detection Design. In Military Communications Conference,Orlando, FL, USA,2007.1-7.
[74]Malhi A, Gao R X. Pca-Based Feature Selection Scheme for Machine Defect Classification. Instrumentation and Measurement, IEEE Transactions on, 2004,53(6):1517-1525.
[75]Mao K Z. Feature Subset Selection for Support Vector Machines through Discriminative Function Pruning Analysis. IEEE TRANSACTIONS ON SYSTEMS MAN AND CYBERNETICS PART B-CYBERNETICS, 2004,34(1):60-67.
[76]Hardin D, Tsamardinos I, Aliferis C F. A Theoretical Characterization of Linear Svm-Based Feature Selection.In ICML'04:Twenty-first international conference on Machine learning,2004.1-8.
[77]Chang S, Dasgupta N, Carin L. A Bayesian Approach to Unsupervised Feature Selection and Density Estimation Using Expectation Propagation.LOS ALAMITOS:IEEE COMPUTER SOC,2005:1043-1050.
[78]Ming H. A Rough Set Based Hybrid Method to Feature Selection. In PROCEEDINGS of INTERNATIONAL SYMPOSIUM ON KNOWLEDGE ACQUISITION AND MODELING,LOS ALAMITOS,2008.585-588.
[79]Wang L J, Wang X L, Chen Q C. Ga-Based Feature Subset Clustering for Combination of Multiple Nearest Neighbors Classifiers. Proceedings of Conference on Machine Learning and Cybernetics, Vols 1-9, 2005:2982-2987.
[80]欧阳震诤.不平稳数据流的分类技术研究[学位论文].国防科学技术大学,2009.
[81]Lin X, Yuan Y, Wang W. Stabbing the Sky:Efficient Skyline Computation Over Sliding Windows.In Proceedings of the 21st International Conference on Data Engineering(ICDE), Tokyo,Japan,2005.502-513.
[82]Li W, Canini M, Moore A W, et al. Efficient Application Identification and the Temporal and Spatial Stability of Classification Schema. Computer Networks,2009,53(6):790-809.
[83]Witten I H, Frank E. Data Mining:Practical Machine Learning Tools and Techniques, Second Ed.Morgan Kaufmann Publishers,2005
[84]蒋艳凰,赵强利.机器学习方法.北京：电子工业出版社,2009：246-248.
[85]Liu Y, Li W, Li Y. Network Traffic Classification Using K-Means Clustering. In Computer and Computational Sciences,2007. IMSCCS 2007. Second International Multi-Symposiums on,Iowa City, IA,2007.360-365.
[86]Zhang T, Ramakrishnan R, Livny M. Birch:An Efficient Data Clustering Method for Very Large Databases.In Proceedings of the ACM SIGMOD international conference on Management of data,1996.103-114.
[87]Guha S, Rastogi R. Cure:An Efficient Clustering Algorithm for Large Databases. In Proceedings of the ACM SIGMOD international conference on Management of data,1998.73-84.
[88]Ester M, Kriegel H P, Sander J. A Density-Based Algorithm for Discovering Clusters in Large Spatial Databases with Noise.In Proceedings of 2nd Conference on Knowledge Discovery and Data Mining,1996.226-231.
[89]Ankerst M, Breunig M M, Kriegel H P, et al. Optics:Ordering Points to Identify the Clustering Structure.In Proceedings of the ACM SIGMOD international conference on Management of data,1999.49-60.
[90]Wang W, Yang J, Muntz R. Sting:A Statistical Information Grid Approach to Spatial Data Mining.In Proceedings of the 23rd VLDB Conference, 1997.186-195.
[91]McGregor A, Hall M, Lorier P. Flow Clustering Using Machine Learning Techniques.BERLIN:SPRINGER-VERLAG,2004:205-214.
[92]Zander S, Nguyen T, Armitage G. Automated Traffic Classification and Application Identification Using Machine Learning. LCN 2005:30th Conference on Local Computer Networks, Proceedings,2005:250-257.
[93]Erman J, Arlitt M, Mahanti A. Traffic Classification Using Clustering Algorithms.In Proc.SIGCOMM'06 MineNet Workshop, New York, NY, USA,2006.281-286.
[94]Mahmood A N, Leckie C, Udaya P. An Efficient Clustering Scheme to Exploit Hierarchical Data in Network Traffic Analysis. IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING, 2008,20(6):752-767.
[95]Yang C, Deng F Q, Yang H D. An Unsupervised Anomaly Detection Approach Using Subtractive Clustering and Hidden Markov Model.2007 SECOND INTERNATIONAL CONFERENCE IN COMMUNICATIONS AND NETWORKING IN CHINA, VOLS 1 AND 2,2007:123-126.
[96]Lee K, Kim J, Kwon K H, et al. Ddos Attack Detection Method Using Cluster Analysis. EXPERT SYSTEMS WITH APPLICATIONS, 2008,34(3):1659-1665.
[97]Chalaghan L O, Mishra N, Meyerson A. Streaming-Data Algorithms for High-Quality Clustering. In Proc of IEEE International Conference on Data Engineering, San Jose,CA,2002.685-796.
[98]Aggarwal C C, Han J, Wang J, et al. A Framework for Clustering Evolving Data Streams.In Proceedings of the 29th international conference on Very large data bases, Berlin,Germany,2003.81-92.
[99]Aggarwal C C, Han J, Wang J, et al. On Demand Classification of Data Streams.In Proceedings of the tenth ACM SIGKDD international conference on Knowledge discovery and data mining, Seattle, WA, USA,2004.503-508.
[100]Bernaille L, Teixeira R, Akodkenou I, et al. Traffic Classification On the Fly. COMPUTER COMMUNICATION REVIEW,2006,36(2):23-26.
[101]Pise N N, Kulkarni P. A Survey of Semi-Supervised Learning Methods. In Computational Intelligence and Security,2008. CIS'08. International Conference on,Suzhou,2008.30-34.
[102]Bernaille L, Teixeira R. Early Recognition of Encrypted Applications.BERLIN:SPRINGER-VERLAG BERLIN,2007:165-175.
[103]Alderson D, Li L, Willinger W, et al. Understanding Internet Topology: Principles, Models, and Validation. IEEE-ACM TRANSACTIONS ON NETWORKING,2005,13(6):1205-1218.
[104]Dewaele G, Himura Y, Borgnat P, et al. Unsupervised Host Behavior Classification From Connection Patterns. International Journal of Network Management,2010,25(5):317-337.
[105]Eriksson B, Dasarathy G, Barford P, et al. Toward the Practical Use of Network Tomography for Internet Topology Discovery. In INFOCOM,2010 Proceedings IEEE,San Diego, CA,2010.1-9.
[106]周苗,杨家海,刘洪波等Internet网络拓扑建模.软件学报,2009(1)：109-123.
[107]Dorogovtsev N S, Mendes F J F. Evolution of Networks. Advances in Physics,2002,51:1079-1187.
[108]Waxman M B. Routing of Multipoint Connections. IEEE Journal on Selected Areas in Communications,1988,6(9):1617-1622.
[109]Doar M. A Better Model for Generating Test Networks. In Proceedings of the IEEE GLOBECOM,London, UK,1996.86-93.
[110]Zegura E W, Calvert K, Bhattacharjee S. How to Model an Internetwork. In Proceedings of the IEEE Fifteenth Annual Joint Conference of Networking the Next Generation,San Francisco, USA,1996.594-602.
[111]Faloutsos C, Faloutsos M, Faloutsos P. On Power-Law Relationships of the Internet Topology. In SIGCOMM'99 Proceedings of the conference on Applications, technologies, architectures, and protocols for computer communication,Massachusetts, USA,1999.251-262.
[112]Dewaele G, Himura Y, Borgnat P, et al. Unsupervised Host Behavior Classification From Connection Patterns. International Journal of Network Management,2010,20(5):317-337.
[113]Yin Z, Roughan M, Lund C, et al. Estimating Point-to-Point and Point-to-Multipoint Traffic Matrices:An Information-Theoretic Approach. Networking, IEEE/ACM Transactions on,2005,13(5):947-960.
[114]张文铸,刘佳,袁坚等.基于PCA的对等网络流量时空特性监测.清华大学学报(自然科学版),2010(4)：561-564.
[115]Erman J, Mahanti A, Arlitt M, et al. Semi-Supervised Network Traffic Classification.NEW YORK:ASSOC COMPUTING MACHINERY, 2007:369-370.
[116]Theodoridis S., Koutroumbas K模式识别.李晶皎,王爱侠,张广渊,译.第三版.北京：电子工业出版社,2006.
[117]Ouyang Z Z, Zhou M, Wang T, et al. Mining Concept-Drifting and Noisy Data Streams Using Ensemble Classifiers. Proceedings of conference on artificial intelligence and computational intellligence,2009:360-364.
[118]Morita M, Oliveira L S, Sabourin R. Generating Ensemble of Classifiers through Unsupervised Feature Selection. Latin America Transactions, IEEE (Revista IEEE America Latina),2005,3(5):71-77.
[119]Zhu X Q, Zhang P, Lin X D, et al. Active Learning From Stream Data Using Optimal Weight Classifier Ensemble. IEEE TRANSACTIONS ON SYSTEMS MAN AND CYBERNETICS,2010,40(6):1607-1621.
[120]Szabo G, Szabo I, Orincsay D. Accurate Traffic Classification. In IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks,Espoo, Finland,2007.1-8.
[121]Chu F, Zaniolo C. Fast and Light Boosting for Adaptive Mining of Data Streams. In PAKDD,2004.282-292.
[122]Street W N, Kim Y S. A Streaming Ensemble Algorithm for Large-Scale Classification. In Proceeding of the 7th ACM SIGKDD Int. Conference on Knowledge Discovery and Data Mining,2001.377-382.
[123]Wang H, Fan W, Yu P S, et al. Mining Concept-Drifting Data Streams Using Ensemble Classifiers.In Proceedings of the ninth ACM SIGKDD, Washington,2003.226-235.
[124]温熙森.模式识别与状态检测.北京：科学出版社,2007.
[125]Kittler J, Hatef M, Duin R. On Combining Classifiers. IEEE Transaction Pattern Analysis and Machine Intelligence,1998,20(3):226-239.
[126]李弼程,黄洁,高世海.信息融合技术及其应用国防工业出版社,2010
[127]Yang J B, Xu D L. On the Evidential Reasoning Algorithm for Multiattribute Decision Analysis Under Uncertainty. IEEE Transactions on Systems, Man, and Cybernetics Part A:Systems and Humans,2002,32(3):289-304.
[128]Hu Y, Gao J, Hu L M. A New Method of Determining the Basic Belief Assignment in D-S Evidence Theory. In International Conference on Machine Learning and Cybernetics,2003.3208-3211.
[129]Xu L, Krzyzak A, Suen C Y. Mehtods for Combining Multiple Classifiers and their Applications in Handwritten Charachter Recognition. IEEE Transactions on systems Man And Cybernetics,1992,22(3):418-435.
[130]Brownlee N, Mills C, Ruth G. Traffic Flow Measurement:Architeeture. Ietf: Rfc2722[S].1999.
[131]Keutzer K, Newton A R, RAbaey J M. System Level Design: Orthognalization Ofnconcerns and Platform-Based Design. IEEE Transactions On Computer-Aided Design Of Integrated Circuits And Systems,2000,19(12):1523-1543.
[132]George L, Blume M. Taming the Ixp Network Processor. ACM Sigplan Notices Archive,2003,38(5):26-37.
[133]杨阳.证据推理组合方法的分类、评价准则及应用研究[学位论文].西北工业大学,2006.
[2]Azuri C. Ipoque Internet Study 2007:P2P File Sharing Still Dominates the Worldwide Internet. http://www.ipoque.com.
[3]Internet Assigned Numbers Authority, http://www.iana.org.2010.
[4]CAIDA. Coralreef. http://www.caida.org/tools/measurement/coralreef/ status.xm1.2010.
[5]Sen S, Wang J. Analyzing Peer-to-Peer Traffic Across Large Networks. IEEE/ACM Transactions on Networking,2004,12(2):219-232.
[6]Aiello W, Kalmanek C, McDaniel P, et al. Analysis of Communities of Interest in Data Networks.BERLIN:SPRINGER-VERLAG BERLIN, 2005:83-96.
[7]Karagiannis T, Papagiannaki K, Faloutsos M. Blinc:Multilevel Traffic Classification in the Dark. COMPUTER COMMUNICATION REVIEW, 2005,35(4):229-240.
[8]Xu K, Zhang Z L, Bhattacharyya S. Internet Traffic Behavior Profiling for Network Security Monitoring. IEEE-ACM TRANSACTIONS ON NETWORKING,2008,16(6):1241-1252.
[9]Constantinou F, Mavrommatis P. Identifying Known and Unknown Peer-to-Peer Traffic. In Proceedings of Fifth IEEE International Symposium on Network Computing and Applications,NEW YORK,2006.93-100.
[10]Agrawal A, Kumar K R P, Athithan G. Sip/Rtp Session Analysis and Tracking for Voip Logging.In 16th IEEE International Conference on Networks,,2008.1-5.
[11]陈贞翔.具有规模适应性的互联网流量识别方法研究[学位论文].山东大学,2008.
[12]Sen S, Spatscheck O, Wang D. Accurate, Scalable in-Network Identification of P2P Traffic Using Application Signatures.In Proceedings of the 13th conference on WWW, New York, USA,2004.512-521.
[13]Chen Z X, Yang B, Chen Y H, et al. Online Hybrid Traffic Classifier for Peer-to-Peer Systems Based On Network Processors. Applied Soft Computing,2009,9(2):685-694.
[14]L7-Filter. http://sourceforge.net/projects/17-filter/.2009.
[15]Cisco. Cisco Ios Technologies. http://www.cisco.com/.
[16]Gong Y. Identifying P2P Users Using Traffic Analysis. http://www.securityfocus.com/infocus/1843.2009.
[17]Bonfiglio D, Mellia M, Meo M, et al. Detailed Analysis of Skype Traffic. IEEE TRANSACTIONS ON MULTIMEDIA,2009,11(1):117-127.
[18]Callado A, Kamienski C, Szabo G, et al. A Survey On Internet Traffic Identification. IEEE COMMUNICATIONS SURVEYS AND TUTORIALS, 2009,11(3):37-52.
[19]Frost V S, Melamed B. Traffic Modeling for Telecommunications Networks. IEEE Communications Magazine,1994,32(3):70-81.
[20]Leland W E, Willinger W, Taqqu M S, et al. On the Self-Similar Nature of Ethernet Traffic (Extended Version). IEEE/ACM Trans.On Networking, 1994,2(1):1-15.
[21]Paxson V, Floyd S. Wide Area Traffic:The Failure of Poisson Modeling. IEEE/ACM Transactions on Networking,1995,3(3):226-244.
[22]Tsybakov B, Georganas N D. Self-Similar Processes in Communications Networks. IEEE Trans. on Information Theory,1998,44(5):1713-1725.
[23]Riedi R H, Crouse M S, Ribeiro V J, et al. A Multifractal Wavelet Model with Application to Network Traffic. Information Theory, IEEE Transactions on,1999,45(3):992-1018.
[24]Balamash A, Krunz M. A Parsimonious Multifractal Model for Www Traffic. Web Engineering and Peer to Peer Computing,2002,2376:1-14.
[25]Erramilli A, Roughan M, Veitch D, et al. Self-Similar Traffic and Network Dynamics. Proceedings of the IEEE,2002,90(5):800-819.
[26]杨谈,崔毅东,金跃辉等.基于混沌理论的网络流量性能评估.电子与信息学报,2009(12)：2993-2996.
[27]Willinger W, Taqqu M S, Sherman R, et al. Self-Similarity through High-Variability:Statistical Analysis of Ethernet Lan Traffic at the Source Level. IEEE/ACM Transactions on Networking,1997,5(1):71-86.
[28]Clark G A, Sengupta S K, Aimonetti W D, et al. Multispectral Image Feature Selection for Land Mine Detection. Geoscience and Remote Sensing, IEEE Transactions on,2000,38(1):304-311.
[29]Mandelbrot B B. The Fractal Geometry of Nature. New York:Freeman, 1983
[30]Taqqu M, Teverovsky V, Willinger W. Estimators for Long-Range Dependence:An Empirical Study. Fractals,1995,3:785-798.
[31]Norros I. A Storage Model with Self-Similar Input. Queueing System, 1994,16:387-396.
[32]Mandelbrot B B. Limit Lognormal Multifractal Measures. In Frontiers of Physics:Landau Memorial Conference,1989.309-340.
[33]Zhang H F, Shu Y T. Estimation of Hurst Parameter by Varianee--Time Plots. In IEEE Pacific Rim Conference on Communications, Computers and Signal Processing,1997.883-886.
[34]Lau W, Erramilli A, Wang J L, et al. Self-Similar Traffic Parameter Estimation:A Semi-Parametric Periodogram-Based Algorithm.In IEEE Global Telecommunications Conference,1995.2225-2231.
[35]Abry P, Veitch D. Wavelet Analysis of Long-Range-Dependent Traffic. IEEE Transactions on Information Theory,1998,44(1):2-15.
[36]Feldmann A, Gilbert A C, Willinger W. Data Networks as Cascades: Investigating the Multifractal Nature of Internet Wan Traffic. ACM SIGCOMM Computer Communication Review,1998,28(4):42-55.
[37]Veres A, Boda M. The Chaotic Nature of Tcp Congestion Control. In IEEE INFOCOM,Tel Aviv,2000
[38]Zhang Z, Ribeiro V J, Moon S, et al. Small-Time Scaling Behaviors of Internet Backbone Traffic:An Empirical Study. IEEE INFOCOM, 2003,3:1826-1836.
[39]The Cooperative Association for Internet Data Analysis(Caida). http://www.caida.org/data/overview/.2010.
[40]林青家.基于小波的网络流量的特性刻画与模型建立[学位论文].山东大学,2007.
[41]Hohn N, Veitch D, Abry P. Does Fractal Scaling at the Ip Level Depend On Tcp Flow Arrival Processes?In Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment, Marseille, France,2002.63-68.
[42]Williams N, Zander S, Armitage G. A Preliminary Performance Comparison of Five Machine Learning Algorithms for Practical Ip Traffic Flow Classification. SIGCOMM Comput. Commun. Rev.,2006,36(5):5-16.
[43]Langley P. Elements of Machine Learning.Morgan Kaufmann,1996.
[44]Mitchell M. Machine Learning.New York:McGraw-Hill,1997.
[45]Alpaydin E. Introduction to Machine Learning.MIT Press,2004.
[46]Nguyen T, Armitage G. Training On Multiple Sub-Flows to Optimise the Use of Machine Learning Classifiers in Real-World Ip Networks.NEW YORK:IEEE,2006:369-376.
[47]Moore A W, Papagiannaki K. Toward the Accurate Identification of Network Applications.DOVROLIS C. Passive and Active Network Measurement. BERLIN:SPRINGER-VERLAG BERLIN,2005:41-54.
[48]Bernaille L, Teixeira R. Implementation Issues of Early Application Identification.FDIDA S, SUGIURA K. Sustainable Internet. BERLIN: SPRINGER-VERLAG BERLIN,2007:156-166.
[49]Erman J, Mahanti A, Arlitt M, et al. Offline/Realtime Traffic Classification Using Semi-Supervised Learning. PERFORMANCE EVALUATION, 2007,64(9-12):1194-1213.
[50]黄晓璐.网络流量的半马尔柯夫模型[学位论文].中国科学院研究生院(计算技术研究所),2006.
[51]Quinlan J R. C4.5:Programs for Machine Learning.San Mateo:Morgan Kaufmann,1993.
[52]马永立,钱宗珏,寿国础等.机器学习用于网络流量识别.北京邮电大学学报,2009(1)：65-68.
[53]林平.网络流量的离线分析[学位论文].北京邮电大学,2010.
[54]Mehta M, Agrawal R, Rissanen J. Sliq:A Fast Scalable Classifier for Data Mining.In proceedings of 5th International Conference on Extending Database Technology, Avignon, France,1996.18-32.
[55]Shafer J, Agrawal R, Mehta M. Sprint:A Fast Scalable Parallel Classifier for Data. In Proceedings of International Conference on Very Large Data Bases (VLDB's96), Bombay,India,1996.544-555.
[56]徐鹏,林森.基于C4.5决策树的流量分类方法.软件学报,2009(10)：2692-2704.
[57]Moore A W, Zuev D. Internet Traffic Classification Using Bayesian Analysis Techniques.In Proceedings of the 2005 ACM SIGMETRICS international conference on Measurement and modeling of computer systems, Banff, Alberta, Canada,2005.50-60.
[58]Widmer G, Kubat M. Learning in the Presence of Concept Drift and Hidden Contexts. Maehine Learning,1996,23(1):10-69.
[59]Domingos P, Hulten G. Mining High-Speed Data Streams.In Proceedings of the sixth ACM SIGKDD international conference on Knowledge discovery and data mining, Boston, Massachusetts, United States,2000.71-80.
[60]Last M. Online Classification of Nonstationary Data Streams. Intelligent Data Analysis,2002,6(2):129-147.
[61]Hulten G, Spencer L, Domingos P. Mining Time-Changing Data Streams.In Proceedings of the seventh ACM SIGKDD, San Francisco, California, 2001.97-106.
[62]王永利.数据流概要与数据流分析若干关键问题研究[学位论文].东南大学,2006.
[63]Dash M, Liu H. Feature Selection for Classification. Intelligent Data Analysis,1997,1(3):131-156.
[64]Doak J. an Evaluation of Feature Selection Methods and their Application to Computer Security.Technical Report, Univ. Of California at Davis, Dept. Computer Science[R].1992.
[65]Liu H, Motoda H. Chapter 1 "Less is More," Feature Extraction,Construction and Selection:A Data Mining Perspective.second printing.2001:3-12.
[66]Liu H, Yu L. Toward Integrating Feature Selection Algorithms for Classification and Clustering. IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING,2005,17(4):491-502.
[67]Dash M, Choi K, Scheuermann P, et al. Feature Selection for Clustering-A Filter Solution. In Data Mining,2002. ICDM 2002. Proceedings.2002 IEEE International Conference on,2002.115-122.
[68]Lipo W, Nina Z, Feng C. A General Wrapper Approach to Selection of Class-Dependent Features. Neural Networks, IEEE Transactions on, 2008,19(7):1267-1278.
[69]Hruschka E R, Hruschka E R, Covoes T F, et al. Feature Selection for Clustering Problems:A Hybrid Algorithm that Iterates Between K-Means and a Bayesian Filter. In Proceedings of 5th International Conference on Hybrid Intelligent Systems,LOS ALAMITOS,2005.405-410.
[70]Dai L, Yun X, Xiao J. Optimizing Traffic Classification Using Hybrid Feature Selection. In Proceedings of The Ninth International Conference on Web-Age Information Management,Zhangjiajie Hunan,2008.520-525.
[71]Domingos P, Hulten G. Mining High-Speed Data Streams.In Proceedings of the seventh ACM SIGKDD international conference on Knowledge discovery and data mining,2000.71-80.
[72]Deng Y, Liu J. Feature Selection Based On Mutual Information for Language Recognition. In PROCEEDINGS OF THE 2ND INTERNATIONAL CONGRESS ON IMAGE AND SIGNAL PROCESSING,NEW YORK,2009.4319-4322.
[73]Chou T, Yen K K, Luo J, et al. Correlation-Based Feature Selection for Intrusion Detection Design. In Military Communications Conference,Orlando, FL, USA,2007.1-7.
[74]Malhi A, Gao R X. Pca-Based Feature Selection Scheme for Machine Defect Classification. Instrumentation and Measurement, IEEE Transactions on, 2004,53(6):1517-1525.
[75]Mao K Z. Feature Subset Selection for Support Vector Machines through Discriminative Function Pruning Analysis. IEEE TRANSACTIONS ON SYSTEMS MAN AND CYBERNETICS PART B-CYBERNETICS, 2004,34(1):60-67.
[76]Hardin D, Tsamardinos I, Aliferis C F. A Theoretical Characterization of Linear Svm-Based Feature Selection.In ICML'04:Twenty-first international conference on Machine learning,2004.1-8.
[77]Chang S, Dasgupta N, Carin L. A Bayesian Approach to Unsupervised Feature Selection and Density Estimation Using Expectation Propagation.LOS ALAMITOS:IEEE COMPUTER SOC,2005:1043-1050.
[78]Ming H. A Rough Set Based Hybrid Method to Feature Selection. In PROCEEDINGS of INTERNATIONAL SYMPOSIUM ON KNOWLEDGE ACQUISITION AND MODELING,LOS ALAMITOS,2008.585-588.
[79]Wang L J, Wang X L, Chen Q C. Ga-Based Feature Subset Clustering for Combination of Multiple Nearest Neighbors Classifiers. Proceedings of Conference on Machine Learning and Cybernetics, Vols 1-9, 2005:2982-2987.
[80]欧阳震诤.不平稳数据流的分类技术研究[学位论文].国防科学技术大学,2009.
[81]Lin X, Yuan Y, Wang W. Stabbing the Sky:Efficient Skyline Computation Over Sliding Windows.In Proceedings of the 21st International Conference on Data Engineering(ICDE), Tokyo,Japan,2005.502-513.
[82]Li W, Canini M, Moore A W, et al. Efficient Application Identification and the Temporal and Spatial Stability of Classification Schema. Computer Networks,2009,53(6):790-809.
[83]Witten I H, Frank E. Data Mining:Practical Machine Learning Tools and Techniques, Second Ed.Morgan Kaufmann Publishers,2005
[84]蒋艳凰,赵强利.机器学习方法.北京：电子工业出版社,2009：246-248.
[85]Liu Y, Li W, Li Y. Network Traffic Classification Using K-Means Clustering. In Computer and Computational Sciences,2007. IMSCCS 2007. Second International Multi-Symposiums on,Iowa City, IA,2007.360-365.
[86]Zhang T, Ramakrishnan R, Livny M. Birch:An Efficient Data Clustering Method for Very Large Databases.In Proceedings of the ACM SIGMOD international conference on Management of data,1996.103-114.
[87]Guha S, Rastogi R. Cure:An Efficient Clustering Algorithm for Large Databases. In Proceedings of the ACM SIGMOD international conference on Management of data,1998.73-84.
[88]Ester M, Kriegel H P, Sander J. A Density-Based Algorithm for Discovering Clusters in Large Spatial Databases with Noise.In Proceedings of 2nd Conference on Knowledge Discovery and Data Mining,1996.226-231.
[89]Ankerst M, Breunig M M, Kriegel H P, et al. Optics:Ordering Points to Identify the Clustering Structure.In Proceedings of the ACM SIGMOD international conference on Management of data,1999.49-60.
[90]Wang W, Yang J, Muntz R. Sting:A Statistical Information Grid Approach to Spatial Data Mining.In Proceedings of the 23rd VLDB Conference, 1997.186-195.
[91]McGregor A, Hall M, Lorier P. Flow Clustering Using Machine Learning Techniques.BERLIN:SPRINGER-VERLAG,2004:205-214.
[92]Zander S, Nguyen T, Armitage G. Automated Traffic Classification and Application Identification Using Machine Learning. LCN 2005:30th Conference on Local Computer Networks, Proceedings,2005:250-257.
[93]Erman J, Arlitt M, Mahanti A. Traffic Classification Using Clustering Algorithms.In Proc.SIGCOMM'06 MineNet Workshop, New York, NY, USA,2006.281-286.
[94]Mahmood A N, Leckie C, Udaya P. An Efficient Clustering Scheme to Exploit Hierarchical Data in Network Traffic Analysis. IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING, 2008,20(6):752-767.
[95]Yang C, Deng F Q, Yang H D. An Unsupervised Anomaly Detection Approach Using Subtractive Clustering and Hidden Markov Model.2007 SECOND INTERNATIONAL CONFERENCE IN COMMUNICATIONS AND NETWORKING IN CHINA, VOLS 1 AND 2,2007:123-126.
[96]Lee K, Kim J, Kwon K H, et al. Ddos Attack Detection Method Using Cluster Analysis. EXPERT SYSTEMS WITH APPLICATIONS, 2008,34(3):1659-1665.
[97]Chalaghan L O, Mishra N, Meyerson A. Streaming-Data Algorithms for High-Quality Clustering. In Proc of IEEE International Conference on Data Engineering, San Jose,CA,2002.685-796.
[98]Aggarwal C C, Han J, Wang J, et al. A Framework for Clustering Evolving Data Streams.In Proceedings of the 29th international conference on Very large data bases, Berlin,Germany,2003.81-92.
[99]Aggarwal C C, Han J, Wang J, et al. On Demand Classification of Data Streams.In Proceedings of the tenth ACM SIGKDD international conference on Knowledge discovery and data mining, Seattle, WA, USA,2004.503-508.
[100]Bernaille L, Teixeira R, Akodkenou I, et al. Traffic Classification On the Fly. COMPUTER COMMUNICATION REVIEW,2006,36(2):23-26.
[101]Pise N N, Kulkarni P. A Survey of Semi-Supervised Learning Methods. In Computational Intelligence and Security,2008. CIS'08. International Conference on,Suzhou,2008.30-34.
[102]Bernaille L, Teixeira R. Early Recognition of Encrypted Applications.BERLIN:SPRINGER-VERLAG BERLIN,2007:165-175.
[103]Alderson D, Li L, Willinger W, et al. Understanding Internet Topology: Principles, Models, and Validation. IEEE-ACM TRANSACTIONS ON NETWORKING,2005,13(6):1205-1218.
[104]Dewaele G, Himura Y, Borgnat P, et al. Unsupervised Host Behavior Classification From Connection Patterns. International Journal of Network Management,2010,25(5):317-337.
[105]Eriksson B, Dasarathy G, Barford P, et al. Toward the Practical Use of Network Tomography for Internet Topology Discovery. In INFOCOM,2010 Proceedings IEEE,San Diego, CA,2010.1-9.
[106]周苗,杨家海,刘洪波等Internet网络拓扑建模.软件学报,2009(1)：109-123.
[107]Dorogovtsev N S, Mendes F J F. Evolution of Networks. Advances in Physics,2002,51:1079-1187.
[108]Waxman M B. Routing of Multipoint Connections. IEEE Journal on Selected Areas in Communications,1988,6(9):1617-1622.
[109]Doar M. A Better Model for Generating Test Networks. In Proceedings of the IEEE GLOBECOM,London, UK,1996.86-93.
[110]Zegura E W, Calvert K, Bhattacharjee S. How to Model an Internetwork. In Proceedings of the IEEE Fifteenth Annual Joint Conference of Networking the Next Generation,San Francisco, USA,1996.594-602.
[111]Faloutsos C, Faloutsos M, Faloutsos P. On Power-Law Relationships of the Internet Topology. In SIGCOMM'99 Proceedings of the conference on Applications, technologies, architectures, and protocols for computer communication,Massachusetts, USA,1999.251-262.
[112]Dewaele G, Himura Y, Borgnat P, et al. Unsupervised Host Behavior Classification From Connection Patterns. International Journal of Network Management,2010,20(5):317-337.
[113]Yin Z, Roughan M, Lund C, et al. Estimating Point-to-Point and Point-to-Multipoint Traffic Matrices:An Information-Theoretic Approach. Networking, IEEE/ACM Transactions on,2005,13(5):947-960.
[114]张文铸,刘佳,袁坚等.基于PCA的对等网络流量时空特性监测.清华大学学报(自然科学版),2010(4)：561-564.
[115]Erman J, Mahanti A, Arlitt M, et al. Semi-Supervised Network Traffic Classification.NEW YORK:ASSOC COMPUTING MACHINERY, 2007:369-370.
[116]Theodoridis S., Koutroumbas K模式识别.李晶皎,王爱侠,张广渊,译.第三版.北京：电子工业出版社,2006.
[117]Ouyang Z Z, Zhou M, Wang T, et al. Mining Concept-Drifting and Noisy Data Streams Using Ensemble Classifiers. Proceedings of conference on artificial intelligence and computational intellligence,2009:360-364.
[118]Morita M, Oliveira L S, Sabourin R. Generating Ensemble of Classifiers through Unsupervised Feature Selection. Latin America Transactions, IEEE (Revista IEEE America Latina),2005,3(5):71-77.
[119]Zhu X Q, Zhang P, Lin X D, et al. Active Learning From Stream Data Using Optimal Weight Classifier Ensemble. IEEE TRANSACTIONS ON SYSTEMS MAN AND CYBERNETICS,2010,40(6):1607-1621.
[120]Szabo G, Szabo I, Orincsay D. Accurate Traffic Classification. In IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks,Espoo, Finland,2007.1-8.
[121]Chu F, Zaniolo C. Fast and Light Boosting for Adaptive Mining of Data Streams. In PAKDD,2004.282-292.
[122]Street W N, Kim Y S. A Streaming Ensemble Algorithm for Large-Scale Classification. In Proceeding of the 7th ACM SIGKDD Int. Conference on Knowledge Discovery and Data Mining,2001.377-382.
[123]Wang H, Fan W, Yu P S, et al. Mining Concept-Drifting Data Streams Using Ensemble Classifiers.In Proceedings of the ninth ACM SIGKDD, Washington,2003.226-235.
[124]温熙森.模式识别与状态检测.北京：科学出版社,2007.
[125]Kittler J, Hatef M, Duin R. On Combining Classifiers. IEEE Transaction Pattern Analysis and Machine Intelligence,1998,20(3):226-239.
[126]李弼程,黄洁,高世海.信息融合技术及其应用国防工业出版社,2010
[127]Yang J B, Xu D L. On the Evidential Reasoning Algorithm for Multiattribute Decision Analysis Under Uncertainty. IEEE Transactions on Systems, Man, and Cybernetics Part A:Systems and Humans,2002,32(3):289-304.
[128]Hu Y, Gao J, Hu L M. A New Method of Determining the Basic Belief Assignment in D-S Evidence Theory. In International Conference on Machine Learning and Cybernetics,2003.3208-3211.
[129]Xu L, Krzyzak A, Suen C Y. Mehtods for Combining Multiple Classifiers and their Applications in Handwritten Charachter Recognition. IEEE Transactions on systems Man And Cybernetics,1992,22(3):418-435.
[130]Brownlee N, Mills C, Ruth G. Traffic Flow Measurement:Architeeture. Ietf: Rfc2722[S].1999.
[131]Keutzer K, Newton A R, RAbaey J M. System Level Design: Orthognalization Ofnconcerns and Platform-Based Design. IEEE Transactions On Computer-Aided Design Of Integrated Circuits And Systems,2000,19(12):1523-1543.
[132]George L, Blume M. Taming the Ixp Network Processor. ACM Sigplan Notices Archive,2003,38(5):26-37.
[133]杨阳.证据推理组合方法的分类、评价准则及应用研究[学位论文].西北工业大学,2006.