基于离散序列报文的协议格式特征自动提取算法

doi:10.11772/j.issn.1001-9081.2017.04.0954

计算机应用 ›› 2017, Vol. 37 ›› Issue (4): 954-959.DOI: 10.11772/j.issn.1001-9081.2017.04.0954

基于离散序列报文的协议格式特征自动提取算法

李阳, 李青, 张霞

信息工程大学信息系统工程学院, 郑州 450002

收稿日期:2016-09-28 修回日期:2016-10-09 出版日期:2017-04-10 发布日期:2017-04-19
通讯作者: 李青
作者简介:李阳(1991-),男,河南柘城人,硕士研究生,主要研究方向:数据挖掘、流量分类;李青(1976-),女,河北正定人,副教授,博士,主要研究方向:网络数据逆向处理、可见光通信、无线自组织网、传感网;张霞(1979-),女,山东济南人,讲师,博士,主要研究方向:机器学习、网络协议分析。

Automatic protocol format signature construction algorithm based on discrete series protocol message

LI Yang, LI Qing, ZHANG Xia

College of Information System Engineering, Information Engineering University, Zhengzhou Henan 45002, China

Received:2016-09-28 Revised:2016-10-09 Online:2017-04-10 Published:2017-04-19

摘要/Abstract

摘要： 针对缺少会话信息的离散序列报文，提出一种基于离散序列报文的协议格式（SPMbFSC）特征自动提取算法。SPMbFSC在对离散序列报文进行聚类的基础上，通过改进的频繁模式挖掘算法提取出协议关键字，进一步对协议关键字进行选择，筛选出协议格式特征。仿真结果表明，SPMbFSC在以单个报文为颗粒度的识别中对FTP、HTTP等六种协议的识别率均能达到95%以上，在以会话为颗粒度的识别中识别率可达90%。同等实验条件下性能优于自适应特征（AdapSig）提取方法。实验结果表明SPMbFSC不依赖会话数据的完整性，更符合实际应用中由于接收条件限制导致会话信息不完整的情形。

关键词: 离散序列报文, 协议关键字提取, 自适应特征挖掘, 格式特征, 协议识别

Abstract: To deal with the discrete series protocol message without session information, a new Separate Protocol Message based Format Signature Construction (SPMbFSC) algorithm was proposed. First, separate protocol message was clustered, then the keywords of the protocol were extracted by improved frequent pattern mining algorithm. At last, the format signature was acquired by filtering and choosing the keywords. Simulation results show that SPMbFSC is quite accurate and reliable, the recognition rate of SPMbFSC for six protocols (DNS, FTP, HTTP, IMAP, POP3 and IMAP) achieves above 95% when using single message as identification unit, and the recognition rate achieves above 90% when using session as identification unit. SPMbFSC has better performance than Adaptive Application Signature (AdapSig) extraction algorithm under the same experimental conditions. Experimental results indicate that the proposed SPMbFSC does not depend on the integrity of session data, and it is more suitable for processing incomplete discrete seriesprotocol message due to the reception limitation.

Key words: discrete series protocol message, protocol keyword extraction, dadptive format signature mining, format signature, protocol identification

中图分类号:

TP393.8

李阳, 李青, 张霞. 基于离散序列报文的协议格式特征自动提取算法[J]. 计算机应用, 2017, 37(4): 954-959.

LI Yang, LI Qing, ZHANG Xia. Automatic protocol format signature construction algorithm based on discrete series protocol message[J]. Journal of Computer Applications, 2017, 37(4): 954-959.

参考文献

[1] VOLZ B, CAIN E, KOHLER E, et al. Service name and transport protocol port number registry[EB/OL].[2012-06-06]. http://www.iana.org/assignments/port-numbers.
[2] HUANG S, CHEN K, LIU C. A statistical-feature-based approach to Internet traffic classification using machine learning[C]//ICUMT 2009: Proceedings of the 2009 International Conference on Ultra Modern Telecommunications & Workshops. Piscataway, NJ: IEEE, 2009: 1-6.
[3] KARAGIANNIS T, PAPAGIANNAKI K, FALOUTSOS M. BLINC: multilevel traffic classification in the dark[C]//SIGCOMM 2005: Proceedings of the 2005 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications. New York: ACM, 2005: 229-240.
[4] MOORE A W, PAPAGIANNAKI K. Toward the accurate identification of network applications[C]//PAM 2005: Proceedings of the 6th International Conference on Passive and Active Network Measurement. Berlin: Springer, 2005: 41-54.
[5] WANG Y, XIANG Y, YU S-Z. Automatic application signature construction from unknown traffic[C]//Proceedings of the 201024th IEEE International Conference on Advanced Information Networking and Applications. Piscataway, NJ: IEEE, 2010: 1115-1120.
[6] LUO J Z, YU S Z, CAI J. Capturing uncertainty information and categorical characteristics for network payload grouping in protocol reverse engineering[J]. Mathematical Problems in Engineering, 2015, 2015(6): 1-9.
[7] 刘兴彬, 杨建华, 谢高岗, 等. 基于Apriori算法的流量识别特征自动提取方法[J]. 通信学报, 2008, 29(12): 51-59.(LIU X B, YANG J H, XIE G G, et al. Automated mining of packet signatures for traffic identification at application layer with Apriori algorithm[J]. Journal on Communications, 2008, 29(12): 51-59.)
[8] AGRAWAL R, SRIKANT R. Fast algorithms for mining association rules in large databases[C]//VLDB 1994: Proceedings of the 20th International Conference on Very Large Data Bases. San Francisco: Morgan Kaufmann Publishers, 1994: 487-499.
[9] 王变琴, 余顺争. 自适应网络应用特征发现方法[J]. 通信学报, 2013, 34(4): 127-137.(WANG B Q, YU S Z. Adaptive extraction method of network application signatures[J]. Journal on Communications, 2013, 34(4): 127-137.)
[10] 朱玉娜, 韩继红, 袁霖, 等. SPFPA: 一种面向未知安全协议的格式解析方法[J]. 计算机研究与发展, 2015, 52(10): 2200-2211.(ZHU Y N, HAN J H, YUAN L, et al. SPFPA: a format parsing approach for unknown security protocols[J]. Journal of Computer Research and Development, 2015, 52(10): 2200-2211.)
[11] HAN J, PEI J, YIN Y, et al. Mining frequent patterns without candidate generation: a frequent-pattern tree approach[J]. Data Mining & Knowledge Discovery, 2004, 8(1): 53-87.
[12] ESTER M, KRIEGEL H P, SANDER J, et al. A density-based algorithm for discovering clusters in large spatial databases with noise[C]//Proceedings of the Second International Conference on Knowledge Discovery and Data Mining. Menlo Park, CA: AAAI Press, 1996: 226-231.
[13] PEI J, HAN J, MORTAZAVI-ASL B, et al. Mining sequential patterns by pattern-growth: the PrefixSpan approach[J]. IEEE Transactions on Knowledge and Data Engineering, 2004, 16(11): 1424-1440.
[14] HAFFNER P, SEN S, SPATSCHECK O, et al. ACAS: automated construction of application signatures[C]//MineNet 2005: Proceedings of the 2005 ACM SIGCOMM Workshop on Mining Network Data. New York: ACM, 2005: 197-202.
[15] ERMAN J, ARLITT M, MAHANTI A. Traffic classification using clustering algorithms[C]//MineNet 2006: Proceedings of the 2006 SIGCOMM Workshop on Mining Network Data. New York: ACM, 2006: 281-286.
[16] Application layer packet classifier for Linux[EB/OL].[2012-06-02]. http://l7-filter.sourceforge.net/.
[17] Application layer packet classifier for Linux-HOWTO[EB/OL].[2012-06-03]. http://17-filter.sourceforge.net/documents.

基于离散序列报文的协议格式特征自动提取算法

Automatic protocol format signature construction algorithm based on discrete series protocol message

PDF

可视化

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 4

编辑推荐

Metrics

[1]	朱玉娜, 张玉涛, 闫少阁, 范钰丹, 陈韩托. 基于半监督子空间聚类的协议识别方法[J]. 计算机应用, 2021, 41(10): 2900-2904.
[2]	冯文博, 洪征, 吴礼发, 李毅豪, 林培鸿. 基于卷积神经网络的应用层协议识别方法[J]. 计算机应用, 2019, 39(12): 3615-3621.
[3]	冯文博, 洪征, 吴礼发, 付梦琳. 网络协议识别技术综述[J]. 计算机应用, 2019, 39(12): 3604-3614.
[4]	李明伟张大方曾彬黎文伟. 基于有效载荷分析的BT流量识别技术[J]. 计算机应用, 2007, 27(9): 2230-2232.