An internet traffic classification method based on echo state network and improved salp swarm algorithm

ESN

ESN is composed of input layer, reservoir and output layer. The reservoir contains hundreds of sparsely connected neurons, and the connection weights between neurons are randomly generated and fixed. Figure 1 shows the ESN structure.

The state equation and output equation of ESN are as follows (Han & Xu, 2017):

(1)${\displaystyle x\left(t\right)=\phi \left(W_{in}u\left(t\right)+W_{x}x\left(t-1\right)+W_{back}y\left(t-1\right)\right)}$ (2)${\displaystyle y\left(t\right)=f_{out}\left(W_{out}\left(u\left(t\right),x\left(t\right),y\left(t-1\right)\right)\right).}$

where u(t) ∈ R^M×1 is the input vector, y(t) ∈ R^M×1 is the output vector, b_x ∈ R^N×1 is the input bias, and b ∈ R^M×1 is the output bias. The state x(t) ∈ R^N×1 at the current time is calculated from the input vector u(t) at the current time t and the state of the reservoir x(t − 1) at the previous time t − 1. φ(⋅) is the activation function of the neuron, which can select Sigmoid function or tanh function. The element of the input-reservoir connection weight matrix W_in ∈ R^N×K is in the interval [−1,1]. W_x ∈ R^N×N is the internal connection weight matrix of the reservoir. W_back ∈ R^N×L is the output-reservoir connection weight matrix. W_out ∈ R^L×(K+N×L) is the output connection weight matrix. W_in, W_x and W_back are generated randomly and remain unchanged during the training phase of ESN. The network only needs to train the output connection weight matrix W_out, which reduces the computational complexity.

The core of ESN is the reservoir. Its performance depends on four crucial hyperparameters: the size of the reservoir N, spectral radius R, sparse degree D and input scale S. How to select these hyperparameters is very important (Duan & Wang, 2015).

(1) Size of the reservoir

The size of the reservoir N, as the most important hyperparameter affecting the performance of ESN, is the number of neurons in the reservoir. The larger the number of neurons is, the better the classification performance is. However, if the number of neurons is too large, overfitting will be caused.

(2) Spectral radius

The spectral radius R is the absolute value of the maximum eigenvalue of the internal connection weight matrix W_x of the reservoir. R < 1 is a necessary condition to ensure the stability of the network.

(3) Sparse degree

The sparse degree D indicates the sparsity of neuron connections. The neurons in the reservoir are sparsely connected rather than fully connected. The larger the value is, the stronger the nonlinear approximation ability is.

(4) Input scale

The input scale S refers to the scale factor before data is input into the reservoir, and represents the range of input connection weight. According to Eq. (1), it determines the working interval of activation function and the extent to which the input data affect the state of the reservoir. It’s usually in the interval [0,1].

The performance of ESN relies heavily on the above hyperparameters, and the results obtained through different hyperparameter configurations vary greatly.

The advanced SSA

SSA is a new type of SI algorithm with the advantages of high optimization accuracy, good robustness and high convergence rate. SSA divides the population into leaders and followers. They form a salp chain to perform population optimization. To enable it to find the optimal solution more accurately, we improved the SSA.

Population initialization

The uniform distribution of the population can effectively maintain the population diversity and improve the optimization performance. The initial population of SSA is generated randomly. Lack of prior knowledge leads to uneven distribution and poor initial population diversity.

To enhance population diversity and search efficiency, the Tent mapping with reverse learning is introduced to initialize the population. The Tent mapping has the characteristics of randomness, ergodicity and regularity. Thus, it can generate initial salp population with rich diversity. Then, the reverse learning strategy is adopted to optimize the population and generate the reverse population. At last, the population generated by the Tent mapping and its reverse population are merged and sorted. The salps with better fitness value are selected to form the initial population. Tent mapping with reverse learning is introduced to expand the search range of the population, reduce invalid search, and improve the search efficiency. The population generated by Tent mapping is expressed as follows (Arora & An, 2019): (3)${\displaystyle x_{d+1}=\left\{\begin{array}{c}2x_d,0\le x_d\le \frac{1}{2}\hfill \\ 2\left(1-x_d\right),\frac{1}{2}\le x_d\le 1\hfill \end{array}\right.}$ where x_d and x_d+1 are the respective values of the dth and (d + 1)th dimensions of the population generated by the Tent mapping.

The reverse learning strategy is used for the population generated by Tent mapping, and the obtained reverse population is as follows: (4)${\displaystyle x_{d+1}^{\prime }=u_d+l_d-x_{d+1}.}$ where $x_{d+1}^{\prime }$ are the values of the (d + 1)th dimension of the reverse population; u_d is the upper limit of the dth dimension; and l_d is the lower limit of the dth dimension.

Leader position update

Adequate global exploration is helpful for the algorithm to obtain better optimization results. Traditional SSA conducts global exploration by introducing random numbers into leader position update. However, the introduced random numbers have strong randomness and cannot fully perform global exploration. Polynomial operator can maximize the diversification of search domain and enhance the convergence speed of the SSA at the later stage. Therefore, we introduce polynomial operator into leader position update.

The formula of improved leader position update is as follows:

(5)${\displaystyle X_d^{l^{\prime }}=F_d+\delta \cdot \left(u_d-l_d\right)}$ (6)${\displaystyle \delta =\left\{\begin{array}{c}{\left[2u+\left(1-2u\right){\left(1-{\delta }_1\right)}^{{\eta }_m+1}\right]}^{\frac{1}{{\eta }_m+1}-1},u\le 0.5\hfill \\ 1-{\left[2\left(1-u\right)+2\left(u-0.5\right){\left(1-{\delta }_2\right)}^{{\eta }_m+1}\right]}^{\frac{1}{{\eta }_m+1}},u>0.5\hfill \end{array}\right.}$ (7)${\displaystyle {\delta }_1=\left(X_d^l-l_d\right)/\left(u_d-l_d\right)}$ (8)${\displaystyle {\delta }_2=\left(u_d-X_d^l\right)/\left(u_d-l_d\right).}$ where F_d is the food position (i.e., the optimal position of salp in the population); u is the random number in the interval [0,1]; η^m represents the distribution index; $X_d^{l^{\prime }}$ is the position of updated leader on the dth dimension; and $X_d^l$ is the position of current leader on the dth dimension.

Follower position update

At the later stage of iteration, followers will gather near the current food source, which reduces the population diversity and the search ability of the SSA. To avoid the premature phenomenon at the later stage, we introduce dynamic mutation strategy into the follower position update, which increases the diversity of salp population at the later stage and improves the convergence accuracy of the SSA. At present, researchers have proposed a variety of mutation algorithms, such as Gaussian mutation and Cauchy mutation (Li et al., 2017). Compared with Gaussian operator, Cauchy operator has longer wings and can generate a large range of random numbers, so that the SSA has a greater chance to avoid local optimum. In addition, less time is needed to search the nearby area when the peak value is low. Therefore, we introduce Cauchy mutation into follower position update.

The formula of improved follower position update is as follows:

(9)${\displaystyle X_d^{m^{\prime }}=\frac{1}{2}\left(X_d^m+X_d^{m-1}\right)+\eta \ast C\left(0,1\right)\left(u_d-l_d\right)}$ (10)${\displaystyle \eta =e^{-\lambda \frac{t}{T}}.}$ where $X_d^m$ and $X_d^{m-1}$ are the respective positions of the mth and (m − 1)^th followers on the dpth dimension before the update; $X_d^{m^{\prime }}$ is the positions of the mth followers on the dth dimension after the update; η is the mutation weight which decreases with the increase of the number of iteration; T is the maximum number of iteration; t is the current number of iteration; λ is a constant and its value is 10; C(0, 1) is a random number generated by the Cauchy operator and its scaling parameter is 1.

If the mutation frequently occurs during the iteration process, it will not be conducive to the algorithm convergence. Therefore, the mutation trigger mechanism is introduced. If the fitness value of mutated follower position is better, the Cauchy mutation will be introduced into the follower position. Otherwise, the Cauchy mutation will not be introduced.

The steps of the advanced SSA (ASSA) are shown in Algorithm 1.

In Algorithm 1, we at first employ the Tent mapping with reverse learning to initialize the salp population. Then, we calculate the fitness values of salps in the population and sort salps in the population according to the fitness values. The salp position with the best fitness value is regarded as food position. After the food position is selected, there are N − 1 salps left in the population. The salps with the first half of the fitness values are regarded as the leaders, and the others are regarded as followers. We update the position of leaders and followers respectively according to Eqs. (5) and (9). Repeat the above steps until meeting the stopping condition (e.g., the maximum number of iterations). Finally, output the salp position with the best fitness value.

Performance analysis of ASSA

To verify the performance of the ASSA algorithm, two typical functions of Sphere and Griewank, are selected for function optimization and convergence test of the algorithm. Sphere is a unimodal function and Griewank is a multimodal function. We compare ASSA with the PSO, GA and SSA. The number of algorithm iterations is set to 500. The testing results of the four algorithms on the functions are shown in Figs. 2 and 3.

It can be seen from Figs. 2 and 3 that ASSA has obvious advantages in convergence speed and accuracy compared to the PSO, GA, and SSA. Therefore, the performance of the ASSA is significantly improved over the traditional optimization algorithms.

Scheme design

We use ASSA-optimized ESN for Internet traffic classification. The basic idea is as follows: The ASSA is utilized to find the salp position with the best fitness value. At the end of iteration, each dimension of the salp position is assigned to the corresponding hyperparameter of the reservoir of ESN, which establishes the network traffic classification model. The flowchart of ESN-based network traffic classification is shown in Fig. 4. The steps of ESN-based network traffic classification are as follows:

Step 1: Pre-process the network traffic classification dataset. There are two pre-processing ways.

(1) One-hot coding. We implement one-hot coding for discrete features.

(2) Min-max normalization. The large difference between the data of the same attribute affects the training of the network. Therefore, we perform min-max normalization on continuous features.

Step 2: Divide the dataset into training set and testing set.

Step 3: Train the ESN and adjust its hyperparameters.

(1) Initialize the parameters of the ASSA, such as the salp population size and the maximum number of iterations. Use the Tent mapping with reverse learning to initialize the salp population. Each dimension of the individual in the population represents a hyperparameter of the ESN, and different hyperparameters have different ranges. Therefore, each dimension of the individual is constrained.

(2) Assign each dimension of the individual to the corresponding hyperparameter of the ESN: the size of the reservoir N, spectral radius R, sparse degree D and input scale S.

(3) Calculate the fitness values of salps in the population according to the training samples and fitness function, and arrange the fitness values in ascending order to find the salp position with the optimal fitness value. If the stopping condition is met, go to Step 4. Otherwise, go to Step 3. The fitness function is the overall accuracy of network traffic classification.

Step 4: Input the testing data into the trained ESN model, and then get the classification result of each sample.

Experimental dataset

To verify the effectiveness of the proposed scheme, we conduct experiments using two public datasets called Moore dataset (Lopez-Martin et al., 2017) and NISM dataset (Demertzis & Iliadis, 2016), which are from raw traffic data. With a long interval between them, they have different data terminals and IP addresses, which enables the effective evaluation of the generality of the proposed scheme. Each dataset includes the training set and the testing set. The proportion of each category in the training set and testing set is consistent with that of the original dataset. 100,000 samples are randomly selected as the testing set, and the others are the training set.

(1) Moore dataset

The Moore dataset comes from the traffic flowing through the network outlet of a biological institute from 0 to 24 h on August 20, 2003. 377,526 network samples are obtained from the 24 h traffic by sampling algorithm. They are divided into 12 application classes. Each sample contains 249 attributes, among which the last one is the category corresponding to each sample. Table 2 reports the Moore dataset statistics.

(2) NISM dataset

The NISM dataset comes from the network traffic of the Information Technology Operations Center of the U.S. Military Academy in 2013. The dataset contains 713,851 network traffic samples, which are divided into 11 application classes. The NISM dataset statistics are shown in Table 3.

Evaluation index

We use the following evaluation indexes to evaluate the classification performance. The samples in the training set are divided into m application classes. TP_i represents the number of its samples that are correctly classified as belonging to class i. FN_i represents the number of its samples that are misjudged as other types. FP_i represents the number of the samples from other application classes that are misjudged as belonging to class i. The evaluation indexes are defined as follows.

(1) The accuracy rate of class i (11)${\displaystyle Ac{c}_i=T{P}_i/\left(T{P}_i+F{N}_i\right).}$

(2) The recall rate of class i (12)${\displaystyle R_i=T{P}_i/\left(T{P}_i+F{N}_i\right).}$

(3) The F-measure of class i (13)${\displaystyle F_i=2\times P_i\times R_i/\left(P_i+R_i.\right)}$

(4) The overall accuracy rate (14)${\displaystyle OA=\sum _{i=1}^{m}T{P}_i/\sum _{i=1}^m\left(T{P}_i+F{P}_i\right).}$

Among the above indexes, the accuracy and recall rate of per class can reflect the classification performance of the proposed scheme for per class. The F-measure, as the harmonic average of the accuracy and the recall rate, gives a better comprehensive evaluation of the classification ability. In addition, the overall accuracy can reflect the proportion of correctly classified samples to all samples.

Experimental results

(1) Experiments of ESN hyperparameter optimization

The range of ESN hyperparameters is set as follows: The size range of the reservoir is set as [30, 300], the range of spectral radius [0.1, 0.99], the range of sparse degree [0.01, 1], and the range of input scale [0.1, 1]. Mirjalili et al. evaluated SSA on more than 20 test functions and 5 optimization problems, and compared them with typical swarm intelligence optimization algorithms such as PSO, GA, and ABC  (Rizk-Allah et al., 2019). The experimental results show that, compared with above algorithms, SSA has better optimization performance. Therefore, referring to the literature (Hu, Wang & Tao, 2021), the population size is set as 21, and the maximum number of iterations 20. On the Moore dataset and the NISM dataset respectively, the optimal hyperparameter values of ESN selected by ASSA are shown in Table 4.

We utilize PSO, FOA, GA, GWO, SSA and ASSA to optimize the hyperparameters of the ESN. The fitness function, with a direct impact on the optimal solution of the model, is usually defined by the actual problem. For the network traffic classification problem, the overall accuracy is taken as the fitness function. On the Moore dataset and the NISM dataset, the changing curves of the fitness values of the six algorithms in the iteration process are shown in Figs. 5 and 6 respectively.

(2) Comparison of different machine learning algorithms

To verify the effectiveness of the proposed scheme, it is compared with different ML algorithms such as SVM, SAE, CNN, GRU and Deep Belief Networks (DBN) algorithms on Moore dataset and NISM dataset, respectively. On the Moore dataset and the NISM dataset, the parameter values of the comparison algorithms are shown in Tables 5, 6, 7, 8, 9, 10 and 11 and Fig. 7 show the classification results of different algorithms on the two datasets.

For network traffic classification problems, classification time is also an important indicator. Classification time includes training time and testing time. The training time and testing time of each algorithm on the datasets are shown in Table 12.