Network traffic monitoring based on IP Flows is a standard monitoring
approach that can be deployed to various network infrastructures, even the
large IPS-based networks connecting millions of people. Since flow records
traditionally contain only limited information (addresses, transport ports, and
amount of exchanged data), they are also commonly extended for additional
features that enable network traffic analysis with high accuracy. Nevertheless,
the flow extensions are often too large or hard to compute, which limits their
deployment only to smaller-sized networks. This paper proposes a novel extended
IP flow called NetTiSA (Network Time Series Analysed), which is based on the
analysis of the time series of packet sizes. By thoroughly testing 25 different
network classification tasks, we show the broad applicability and high
usability of NetTiSA, which often outperforms the best-performing related
works. For practical deployment, we also consider the sizes of flows extended
for NetTiSA and evaluate the performance impacts of its computation in the flow
exporter. The novel feature set proved universal and deployable to high-speed
ISP networks with 100\,Gbps lines; thus, it enables accurate and widespread
network security protection.

基于 IP 流的网络流量监控是一种标准监控方法，可以部署到各种网络基础设施中，甚至是连接数百万人的大型 IPS 网络。本文提出了一种基于包大小时间序列分析的新型扩展 IP 流 NetTiSA，在 25 个网络分类任务的全面测试中展示了 NetTiSA 的广泛适用性和高可用性，常常超过最佳相关工作的性能。对于实际部署，我们还考虑了用于 NetTiSA 的扩展流的大小，并评估了其在流出口器中计算的性能影响。这种新颖的特征集被证明是通用的，可用于具有 100Gbps 线路的高速 ISP 网络，从而实现了准确而广泛的网络安全保护。

NetTiSA: 以时间序列特征扩展的 IP 流用于通用带宽受限高速网络流量分类

NetTiSA: Extended IP Flow with Time-series Features for Universal  Bandwidth-constrained High-speed Network Traffic Classification

Network traffic monitoring using IP flows is used to handle the current
challenge of analyzing encrypted network communication. Nevertheless, the
packet aggregation into flow records naturally causes information loss;
therefore, this paper proposes a novel flow extension for traffic features
based on the time series analysis of the Single Flow Time series, i.e., a time
series created by the number of bytes in each packet and its timestamp. We
propose 69 universal features based on the statistical analysis of data points,
time domain analysis, packet distribution within the flow timespan, time series
behavior, and frequency domain analysis. We have demonstrated the usability and
universality of the proposed feature vector for various network traffic
classification tasks using 15 well-known publicly available datasets. Our
evaluation shows that the novel feature vector achieves classification
performance similar or better than related works on both binary and multiclass
classification tasks. In more than half of the evaluated tasks, the
classification performance increased by up to 5\%.

通过对单流时间序列进行时间序列分析，本文提出了一种新型流量特征的流扩展，其中 69 个通用特征基于数据点的统计分析、时域分析、流时间跨度内的数据包分布、时间序列行为和频域分析。使用 15 个公开可用的数据集，我们展示了所提出的特征向量在各种网络流量分类任务中的可用性和普适性。评估结果表明，该新型特征向量在二进制和多类分类任务上的分类性能与相关工作相当或更好。在超过一半的评估任务中，分类性能提高了多达 5%。