Method and its devices of network TCP traffic online identification using features in the head of the data flow

A method of online TCP (Transmission Control Protocol) traffic identification using a TCP online identification device in which:

• a first data flow separation module, a features extraction module, and a classification arbitration module are connected in sequence one after another, and
• with the classification arbitration module being connected to a protocol features library module,
• the method comprising:
• using features in a header of a TCP flow, in Steps including:
• Step 1, accessing live traffic data sets by collecting a number of live traffic data sets over a network;
• Step 2, sorting the live traffic data sets by separating the live network traffic data sets obtained in Step 1 into different TCP flows by looking for a start packet in each of the data flows, and a source address, a destination address, a source port, a destination port, and a transport layer protocol type of each packet in the data flows;
• Step 3, classifying the traffic data sets of the TCP flows obtained in Step 2 into different categories so that each of the TCP flows in Step 2 is associated with a corresponding one of the transport layer protocol types;
• Step 4, extracting features of the packets from each of the TCP flows, and constructing a sequence of the extracted features according to an order in which the packets are received in each of the TCP flows;
• Step 5, using the protocol features library to store the extracted features of the packets obtained through analysis of the live traffic data sets;
• and to establish additional groups of probability density matrices according to the transport layer protocol type of the TCP flows in Step 3, and the sequence of the extracted features of the TCP flows in Step 4,
• each of the probability density matrices storing:
• a probability density of one of the packets having extracted features in a specific one of the TCP flows corresponding to an equivalent one of the transport layer protocol types, so that each of the transport layer protocol types has a set of corresponding probability density matrices,
• a probability density of the extracted features of the header of the specific TCP flow corresponding to the equivalent one of the transport layer protocol types;
• Step 6, analyzing the extracted features of the specific TCP flow in an order in which the packets flow in the specific TCP flow in order to form the sequence of the extracted features;
• Step 7, comparing the sequence of the extracted features obtained in Step 6 with the features stored in the protocol features library in Step 5, in order to obtain a probability value of the specific TCP flow belonging to a corresponding one of the transport layer protocol types;
• and
• Step 8, determining a specific transport layer protocol type of the specific TCP flow corresponding to a maximum probability value for the transport layer protocol type according to the probability value in Step 7.