摘要
应用协议识别在网络安全领域具有极其广泛的应用,而如何发现协议特征是协议识别的核心问题。为此,提出一种高效准确的协议特征自动发现方法。利用协议自身的格式特点,将消息进行token化,并根据token序列对消息进行分类。由分类数的变化曲线大致判别协议的首部长度,从而确定字频统计的范围。对数据流中每个数据包的消息首部进行字节频率统计,并将字节频率进行归一化处理,得到字节频率特征向量。通过计算待测协议与样本协议的余弦相似度对协议进行分类和识别。实验结果表明,用该方法所提取的特征进行识别,准确率超过93.5%。
Application protocol identification is widely applied in network security and the key problem of the protocol is how to discover the protocol feature.This paper proposes an efficient and precise method to automatically discover the protocol feature.The method takes advantage of the feature of protocol format to token the message,classify the messages according to the token sequence,and generally discriminate the protocol header length by change curve of classification number.Thus determine the scope of the word frequency statistics.The byte frequency of each data packet message header in data stream is counted and dealt under normalization.It gets the byte frequency vector of the protocol header,and utilizes the cosine similarity by calculating measured protocol and sample protocol to classify and identify the protocol.Experimental result shows that it has a high accuracy over 93.5%using the signature extracted by this method.
出处
《计算机工程》
CAS
CSCD
北大核心
2015年第2期272-277,共6页
Computer Engineering
基金
国家自然科学基金资助项目(61309007)
国家"863"计划基金资助项目(2012AA012902)
关键词
协议识别
token化
字节频率
特征向量
余弦相似度
protocol identification
tokenization
byte frequency
feature vector
cosine similarity
