| Due to the continuous explosive growth and the uncertainty of the fractal character of network traffic,it becomes more and more difficult to distinguish between normal and abnormal traffic accurately and efficiently.The obvious characteristics of self-similarity and long correlation make the traffic patterns traceable when the network runs safely.In most cases,the appearance of "rare" traffic patterns mostly indicates a change of the network security situation.It becomes one of the hot topics that how to depict the security status of the network traffic while the network situation changing.In this thesis,the characteristics of network traffic are taken as the research point,taking advantage of some characteristics of Software-Defined Networking(SDN),e.g.control and forwarding separation,and its management perspective.The network traffic characteristics are depicted according to the statistical information collected from the flow tables of OpenFlow switches.Based on the Kernel-based Growing Self-organizing Mapping(KGSOM)network,the thesis proposes a self-learning algorithm combining with the characteristics of network traffic.The algorithm dynamically acquires the incremental KGSOM network traffic model by continuous self-learning the statistical information of the flow tables.Furthermore,term security profile is introduced to represent the security mode of network traffic,and a security profile analysis algorithm based on the KGSOM network is proposed.The algorithm builds a knowledge network which is based on traffic security pattern(i.e.security profile),according to the incremental learning of the KGSOM network model about the statistical information of the flow tables.For the network traffic which meets the preset condition,the algorithm learns its traffic mode,and dynamically adjusts the boundary of the security profile or adds new knowledge to the KGSOM network.On the other hand,for the stranger traffic mode which does not meet the preset condition,the algorithm dynamically adjusts the security profile of the network and strengthens the security intensity or adds new knowledge to the security profile according to the detection results about whether the stranger traffic is normal or not from the intrusion detection system.The flow table information is the basis for forwarding the data flow,and it is also the embodiment of network traffic characteristics.In this thesis,the incremental learning algorithm is combined with the security profile analysis algorithm.Firstly,the information obtained from the OpenFlow switches is integrated as the samples to be studied.Then the samples are inputted into the KGSOM network for continuous self-learning,and then the traffic model of the KGSOM network is dynamically generated.The KGSOM network traffic model is then used to analyze the security profile of the network.Finally,the abnormal traffic is identified according to the security profile.Meanwhile,the KGSOM network can adjust the network security profile according to the abnormal phenomenon.So that the network security profile is more sensitive to network traffic patterns,especially to some unknown patterns.Through the simulation experiment based on the DARPA 99 data set,the impact of the iteration number and the extended threshold on the incremental learning algorithm is analyzed.And then,the validity of the network security profile analysis algorithm is verified under normal and mixed flows,respectively.Finally,experiments are carried out for comparing and analyzing the security profile analysis algorithms based on the KGSOM and GSOM networks.The experimental results show that the algorithm based on the KGSOM network performs better than the algorithm based on GSOM in time consumption and distinguishing normal traffic,while the GSOM-based algorithm performs well in the recognition of abnormal traffic. |
