基于半监督子空间聚类的协议识别方法

doi:10.11772/j.issn.1001-9081.2020122002

计算机应用 ›› 2021, Vol. 41 ›› Issue (10): 2900-2904.DOI: 10.11772/j.issn.1001-9081.2020122002

所属专题：网络空间安全

基于半监督子空间聚类的协议识别方法

朱玉娜¹, 张玉涛², 闫少阁³, 范钰丹³, 陈韩托⁴

1. 中国人民解放军91033部队, 山东青岛 266035;
2. 中国人民解放军91286部队, 山东青岛 266003;
3. 中国人民解放军信息工程大学, 郑州 450001;
4. 中国人民解放军63850部队, 吉林白城 137001

收稿日期:2020-12-21 修回日期:2021-04-10 出版日期:2021-10-10 发布日期:2021-10-27
通讯作者: 朱玉娜
作者简介:朱玉娜(1985-),女,山东菏泽人,工程师,博士,主要研究方向:密码协议逆向与识别;张玉涛(1981-),男,安徽亳州人,工程师,硕士,主要研究方向:信息安全;闫少阁(1983-),男,河南周口人,研究员,硕士,主要研究方向:信息安全;范钰丹(1982-),女,河南邓州人,讲师,硕士,主要研究方向:密码协议形式化分析与自动化验证;陈韩托(1990-),男,浙江奉化人,助理工程师,硕士,主要研究方向:协议在线安全性分析。

Protocol identification approach based on semi-supervised subspace clustering

ZHU Yuna¹, ZHANG Yutao², YAN Shaoge³, FAN Yudan³, CHEN Hantuo⁴

1. Troops 91033 of PLA, Qingdao Shandong 266035, China;
2. Troops 91286 of PLA, Qingdao Shandong 266003, China;
3. PLA Information Engineering University, Zhengzhou Henan 450001, China;
4. Troops 63850 of PLA, Baicheng Jilin 137001, China

Received:2020-12-21 Revised:2021-04-10 Online:2021-10-10 Published:2021-10-27

摘要/Abstract

摘要： 针对现有的基于统计特征的协议识别方法选择识别特征时未考虑不同协议个体之间的差异的问题，结合半监督学习和模糊子空间聚类（FSC）方法，提出了一种半监督子空间聚类协议识别方法（SSPIA）。首先，将有标签的样本流转化为成对约束信息，从而获取先验约束条件；其次，在此基础上提出半监督模糊子空间聚类（SFSC）算法，该算法利用约束条件指导子空间聚类过程；然后，建立类簇和协议类型的映射，以获取协议各个特征的权重系数，进而构建个体化的密码协议特征库用于后续协议识别；最后，针对5个典型的密码协议进行聚类效果和识别效果实验。实验结果表明，针对基于统计特征的协议识别问题，与传统K-means方法和FSC方法相比，所提SSPIA的聚类效果更好，且SSPIA构建的协议识别分类器更为精确，协议识别率更高，误识别率更低。所提SSPIA提高了基于统计特征的识别效果。

关键词: 密码协议, 协议识别, 统计特征, 半监督学习, 子空间聚类

Abstract: The differences between different protocols are not considered when selecting identification features in the existing statistical feature-based identification methods. In order to solve the problem, a Semi-supervised Subspace-clustering Protocol Identification Approach (SSPIA) was proposed by combining semi-supervised learning and Fuzzy Subspace Clustering (FSC) method. Firstly, the prior constraint condition was obtained by transforming the labeled sample flow into pairwise constraints information. Secondly, the Semi-supervised Fuzzy Subspace Clustering (SFSC) algorithm was proposed on this basis and was used to guide the process of subspace clustering by using the constraint condition. Then, the mapping between class clusters and protocol types was established to obtain the weight coefficient of each protocol feature, and an individualized cryptographic protocol feature library was constructed for subsequent protocol identification. Finally, the clustering effect and identification effect experiments of five typical cryptographic protocols were carried out. Experimental results show that, compared with the traditional K-means method and FSC method, the proposed SSPIA has better clustering effect, and the protocol identification classifier constructed by SSPIA is more accurate, has higher protocol identification rate and lower error identification rate. The proposed SSPIA improves the identification effect based on statistical features.

Key words: cryptographic protocol, protocol identification, statistical feature, semi-supervised learning, subspace clustering

中图分类号:

TP393.08

朱玉娜, 张玉涛, 闫少阁, 范钰丹, 陈韩托. 基于半监督子空间聚类的协议识别方法[J]. 计算机应用, 2021, 41(10): 2900-2904.

ZHU Yuna, ZHANG Yutao, YAN Shaoge, FAN Yudan, CHEN Hantuo. Protocol identification approach based on semi-supervised subspace clustering[J]. Journal of Computer Applications, 2021, 41(10): 2900-2904.

参考文献

[1] SHERRY J, LAN C, POPA R A, et al. BlindBox:deep packet inspection over encrypted traffic[J]. ACM SIGCOMM Computer Communication Review, 2015, 45(4):213-226.
[2] YAO Z J, GE J G, WU Y L, et al. Encrypted traffic classification based on Gaussian mixture models and hidden Markov models[J]. Journal of Network and Computer Applications, 2020, 166:No. 102711.
[3] WANG W, ZHU M, WANG J L, et al. End-to-end encrypted traffic classification with one-dimensional convolution neural networks[C]//Proceedings of the 2017 IEEE International Conference on Intelligence and Security Informatics. Piscataway:IEEE, 2017:43-48.
[4] REN X M, GU H X, WEI W T. Tree-RNN:tree structural recurrent neural network for network traffic classification[J]. Expert Systems with Applications, 2021, 167:No. 114363.
[5] 张震, 汪斌强, 李向涛, 等. 基于近邻传播学习的半监督流量分类方法[J]. 自动化学报, 2013, 39(7):1100-1109.(ZHANG Z, WANG B Q, LI X T, et al. Semi-supervised traffic identification based on affinity propagation[J]. Acta Automatica Sinica, 2013, 39(7):1100-1109.)
[6] 朱玉娜, 韩继红, 袁霖, 等. 面向密码协议在线安全性的监测方法[J]. 通信学报, 2016, 37(6):75-85.(ZHU Y N, HAN J H, YUAN L, et al. Monitoring approach for online security of cryptographic protocol[J]. Journal on Communications, 2016, 37(6):75-85.)
[7] XIE G W, ILIOFOTOU M, KERALAPURA R, et al. SubFlow:towards practical flow-level traffic classification[C]//Proceeding of the 2012 IEEE International Conference on Computer Communication. Piscataway:IEEE, 2012:2541-2545.
[8] GAN G, WU J. A convergence theorem for the Fuzzy Subspace Clustering (FSC) algorithm[J]. Pattern Recognition, 2008, 41(6):1939-1947.
[9] GRIMAUDO L, MELLIA M, BARALIS E, et al. SeLeCT:selflearning classifier for internet traffic[J]. IEEE Transactions on Network and Service Management, 2014, 11(2):144-157.
[10] HAFFNER P, SEN S, SPATSCHECKO, et al. ACAS:automated construction of application signatures[C]//Proceeding of the 2005 ACM SIGCOMM Workshop on Mining Network Data. New York:ACM, 2005:197-202.
[11] ZHANG J, CHEN C, XIANG Y, et al. An effective network traffic classification method with unknown flow detection[J], IEEE Transactions on Network and Service Management, 2013, 10(2):133-147.
[12] WAGSTAFF K, CARDIE C, ROGERS S, et al. Constrained Kmeans clustering with background knowledge[C]//Proceeding of the 18th International Conference on Machine Learning. San Francisco:Morgan Kaufmann Publishers Inc., 2001:577-584.
[13] BERNAILLE L, TEIXEIRA R, SALAMATIAN K. Early application identification[C]//Proceeding of the 2006 ACM CoNEXT Conference. New York:ACM, 2006:No. 6.
[14] 王晨宇, 汪定, 王菲菲, 等. 面向多网关的无线传感器网络多因素认证协议[J]. 计算机学报, 2020, 43(4):683-700.(WANG C Y, WANG D, WANG F F, et al. Multi-factr user authentication scheme for multi-gateway wireless sensor networks[J]. Chinese Journal of Computers, 2020, 43(4):683-700.)
[15] WANG D, WANG P. Two birds with one stone:two-factor authentication with security beyond conventional bound[J]. IEEE Transactions on Dependable and Secure Computing, 2018, 15(4):708-722.

基于半监督子空间聚类的协议识别方法

Protocol identification approach based on semi-supervised subspace clustering

PDF

可视化

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 15

编辑推荐

Metrics

[1]	张师鹏, 李永忠, 杜祥通. 基于半监督学习和三支决策的入侵检测模型[J]. 计算机应用, 2021, 41(9): 2602-2608.
[2]	毛铭泽, 曹芮浩, 闫春钢. 基于权值多样性的半监督分类算法[J]. 计算机应用, 2021, 41(9): 2473-2480.
[3]	曹玉红, 徐海, 刘荪傲, 王紫霄, 李宏亮. 基于深度学习的医学影像分割研究综述[J]. 计算机应用, 2021, 41(8): 2273-2287.
[4]	王丽娟, 陈少敏, 尹明, 许跃颖, 郝志峰, 蔡瑞初, 温雯. 基于近邻图改进的块对角子空间聚类算法[J]. 计算机应用, 2021, 41(1): 36-42.
[5]	曾梦, 宁彬, 蔡之华, 谷琼. 使用深度对抗子空间聚类实现高光谱波段选择[J]. 计算机应用, 2020, 40(2): 381-385.
[6]	王治忠, 钱龙龙, 韩闯, 师丽. 基于统计特征和熵特征融合的心肌梗死辅助诊断方法[J]. 计算机应用, 2020, 40(2): 608-615.
[7]	吕亚丽, 苗钧重, 胡玮昕. 基于标签进行度量学习的图半监督学习算法[J]. 计算机应用, 2020, 40(12): 3430-3436.
[8]	程凯, 王妍, 刘剑飞. 基于生成对抗网络的自动细胞核分割半监督学习方法[J]. 计算机应用, 2020, 40(10): 2917-2922.
[9]	冯文博, 洪征, 吴礼发, 李毅豪, 林培鸿. 基于卷积神经网络的应用层协议识别方法[J]. 计算机应用, 2019, 39(12): 3615-3621.
[10]	冯文博, 洪征, 吴礼发, 付梦琳. 网络协议识别技术综述[J]. 计算机应用, 2019, 39(12): 3604-3614.
[11]	陈可佳, 杨泽宇, 刘峥, 鲁浩. 基于邻域选择策略的图卷积网络模型[J]. 计算机应用, 2019, 39(12): 3415-3419.
[12]	任福龙, 曹鹏, 万超, 赵大哲. 结合代价敏感半监督集成学习的糖尿病视网膜病变分级[J]. 计算机应用, 2018, 38(7): 2124-2129.
[13]	孙圣姿, 万源, 曾成. 自适应嵌入的半监督多视角特征降维方法[J]. 计算机应用, 2018, 38(12): 3391-3398.
[14]	黄华, 郑佳敏, 钱鹏江. 调整聚类假设联合成对约束半监督分类方法[J]. 计算机应用, 2018, 38(11): 3119-3126.
[15]	吕佳, 黎隽男. 结合半监督聚类和数据剪辑的自训练方法[J]. 计算机应用, 2018, 38(1): 110-115.