An Analysis Of Flow Statistical Characteristics In WLAN Networks

With the popularity of WLAN networks,the number of user surged and network application types are also greatly enriched.The study on WLAN traffic characteristics is of great significance to network self-optimization,improvement of network service quality and design of application system and network equipment.According to the self-similarity theory of network traffic,there is some degree of consistency between the local structure and overall structure of traffic data in both time and space dimensions.Therefore,the overall traffic characteristics can be deduced by analyzing traffic characteristics in a unit time.The research work on WLAN traffic in this paper includes following three parts:1.In order to collect and analyze the traffic data in actual scenes,several common methods to capture WLAN traffic are studied,including to obtain data flow based on NetFlow and to obtain network packets based on tcpdump and Wireshark.Among these methods,NetFLow offers a session-level view of network traffic,while network sniffers(tcpdump and Wireshark)can provide a complete record of network traffic.Besides,Wireshark provides a friendly graphical interface for users.Accordingly,this paper proposes an experimental setup based on Soft AP and Wireshark,which avoids packets overflow when the NIC works in promiscuous mode and can obtain traffic data of higher stability and reliability.2.This paper analyzes the traffic statistical features of four common applications,including music player,video player,random web browsing and multimedia social networking website browsing.Studied statistical features include uplink and downlink packet length,packet inter-arrival time and their mean,minimum,maximum value and variance,uplink/downlink traffic ratio,etc.From the distribution images of statistical features,preliminary conclusions on traffic behaviors of the four types of applications can be obtained.From the distribution images of flow statistical features,it can be seen that after logarithmic processing the distribution function has a from quite resembles double Gaussian.Therefore,double Gaussian model is used to fit the samples.Fitting results are compared with Kernel Density Estimation(KDE)and proved to have a good performance.In addition,a traffic feature selection method based on mutual information is proposed in this part.By calculating the mutual information between traffic statistical features and application types,it is theoretically proved that there are correlations between traffic statistical features and application types.In other words,it is feasible to classify the network traffic according to the traffic behavior characteristics.The value of mutual information also indicates the influence of a certain feature on the traffic classification results.3.According to the analysis results of the traffic statistical features,this paper uses a semi-supervised clustering method based on K-means to perform traffic classification,which can be divided into two steps:1)Clustering;2)Mapping clusters to application types.Its advantage lies in the simple class mapping based on probability distribution and the ability to recognize "unknown flow".