A DPI-Based Network Traffic Feature Vector Optimization Model

Network traffic features play a key role in network anomaly detection, which is of great significance to ensure normal network service. Conventional network traffic feature extraction focuses on the network layer to obtain features such as IP source, destination address, timestamp and so on, which describe the status involved in the transmission process of messages, but it lacks the connection with specific application behavior. At the same time, huge feature data will also burden the detection work. In view of the above situation, this paper proposes a DPI-based network traffic feature vector optimization model——DRFV optimization model. This model combines the DPI technology to expand the feature extraction of the original traffic to the application layer, realize the traffic analysis of the application layer data, and expand and increase the feature vector dimension. After obtaining abundant features, the random forest model based on Bagging thought is used to classify the features, obtain feature effect ranking, and select the optimized feature vector according to the conditions required for network anomaly detection, so as to achieve the goal of dimension reduction and optimization, and obtain the feature vector with more research significance. The network anomaly detection model uses the model proposed in this paper to optimize the traffic feature extraction, which can obtain better results in detection results and operating performance. It has a significant improvement in accuracy, F1 value and running time.