移动网络流量分类关键技术研究

Mobile devices have become the most popular way for users to get access to the Internet, and mobile traffic has overtaken traditional fixed network traffic as the dominant component of global Internet traffic. The characteristics of mobile traffic is fundamentally different to that of fixed network traffic, due to their differences in networking scheme, device feature, application model, and user behavior, thus it brings new challenges for mobile traffic classification and management. This research focuses on the key techniques for mobile traffic classification and mobile application/service identification. More specifically, we first study the approach for fine-grained classification of mobile application traffic. In order to realize accurate identification of mobile application and service, we aim to solve the key challenge of large-scale traffic classification by using self-taught feature learning and deep neural network based approach. Secondly, we explore the analytic techniques for encrypted mobile traffic, including the methods for training behavior models for encrypted traffic classification. Thirdly, we investigate the scheme for automatically mining unknown traffic patterns that represent zero-day mobile application, which facilitates enforcement of security and management rules against unknown traffic. The research outcomes of this project are expected to enable advanced application level mobile network security and management functions, which play an important role in the fast and long-term development of mobile computing.

移动设备已成为用户接入互联网的首选设备，而移动网络流量也已超越传统的固定网络流量成为全球互联网流量的主要组成部分。由于组网方式、设备特性、应用模式、用户习惯等多方面的区别，移动网络流量与传统网络流量在流量特性上存在显著区别，这为移动流量的分类管理带来了新的问题与挑战。本课题将重点研究面向移动互联网的流量分类和应用业务识别关键技术，具体包括:(1)研究移动应用流量的精细分类技术，利用流量特征自我学习方法和深度神经网络模型解决大规模流量分类问题，实现海量移动应用及具体业务的精细识别;(2)研究加密移动应用流量分析技术，针对加密移动流量的特性设计有效的加密应用行为模型和分类算法;(3)设计未知移动应用流量的自动学习机制，解决由“零日移动应用“带来的移动互联网管理与安全难题。本项目的研究成果将为应用级移动网络流量的安全和管理提供关键技术支撑，促进移动互联网的繁荣及可持续发展。

移动流量相较于传统网络流量，在流量行为与特征上具有显著区别，本项目围绕移动流量安全管理所面临的大规模流量分类问题、加密流量分类问题、测试域分类不完全问题等关键科学问题展开系统的研究，主要完成了以下三个研究工作。(1)大规模与加密移动流量分类。针对移动应用类别数量庞大、全流量加密等挑战，提出了基于多维流量特征学习与深度神经网络的移动流量分类方法，实现加密与明文流量的通用移动流量精细分类。(2)未知移动流量分类。针对移动网络中的零日应用问题，提出了基于半监督学习的未知移动流量发现机制与分类模型自动更新方法，实现面向已知及未知移动应用流量的统一分类框架。(3)新型网络流量异常行为分析与入侵检测。针对移动网络、软件定义网络、虚拟网络功能等新型网络环境下的流量安全问题，提出了若干异常流量行为分析模型与协同入侵检测机制。本项目研究成果为以移动网络为代表的新型网络流量安全和管理提供了重要的理论与技术支撑。