计算机应用 ›› 2017, Vol. 37 ›› Issue (2): 440-444.DOI: 10.11772/j.issn.1001-9081.2017.02.0440

• 网络与通信 • 上一篇    下一篇

基于前导码挖掘的未知协议帧切分算法

雷东, 王韬, 王晓晗, 马云飞   

  1. 军械工程学院 信息工程系, 石家庄 050003
  • 收稿日期:2016-07-22 修回日期:2016-08-28 出版日期:2017-02-10 发布日期:2017-02-11
  • 通讯作者: 雷东,ldd_lw@163.com
  • 作者简介:雷东(1992-),男,陕西咸阳人,硕士研究生,主要研究方向:网络协议识别;王韬(1964-),男,河北石家庄人,教授,博士,主要研究方向:信息安全、密码旁路分析;王晓晗(1992-),男,河北衡水人,博士研究生,主要研究方向:网络协议识别;马云飞(1992-),男,吉林德惠人,硕士研究生,主要研究方向:分组密码立方攻击。
  • 基金资助:
    国家自然科学基金资助项目(61272491,61309021)。

Unknown protocol frame segmentation algorithm based on preamble mining

LEI Dong, WANG Tao, WANG Xiaohan, MA Yunfei   

  1. Department of Information Engineering, Ordnance Engineering College, Shijiazhuang Hebei 050003, China
  • Received:2016-07-22 Revised:2016-08-28 Online:2017-02-10 Published:2017-02-11
  • Supported by:
    This work is partially supported by the National Natural Science Foundation of China (61272491, 61309021).

摘要: 针对未知协议帧切分技术存在的效率较低的问题,提出基于前导码挖掘的未知协议帧切分技术。首先介绍前导码作为标识链路帧起始位置的原理,分析候选序列选取问题是现有频繁序列挖掘方法无法对长度较长的前导码进行挖掘的原因,并针对该原因以及前导码挖掘的特点提出从目标比特流中发现候选序列、基于候选序列集合大小变化特征的候选序列选取等改进方法;然后提出未知前导码长度的判定与挖掘方法,从挖掘的众多频繁序列中找出前导码序列,进而对帧进行切分;最后通过采集的真实数据对所提方法的有效性进行了验证。实验结果表明,所提方法能够快速准确地挖掘未知协议比特流中的前导码序列,相比现有方法降低了空间与时间复杂度。

关键词: 前导码挖掘, 频繁序列, 帧切分, 未知协议, 比特流

Abstract: Concerning the poor efficiency in unknown protocol frame segmentation, an unknown protocol frame segmentation algorithm based on preamble mining was proposed. Firstly, the principle of the preamble being used as the start of frame was introduced. As the cause that the existing frequent sequence mining algorithm cannot mine long preamble directly, the problems in candidate sequence selection were analyzed. Combining with the characteristics of preamble, two methods for selecting candidate sequences from the target bit streams and selecting candidate sequence based on the variation of the size of candidate sequence set were given. Secondly, an algorithm inferring the length of preamble and mining the preamble was put forward for unknown protocol frame segmentation. Finally, experiments were conducted with real bit streams captured from the Ethernet. The experimental results show that the proposed algorithm can rapidly and accurately mine the preamble sequence in the bit stream of the unknown protocol with lower space and time complexity.

Key words: preamble mining, frequent sequence, frame segmentation, unknown protocol, bit stream

中图分类号: