基于网络特征的协议识别研究与实现

发布时间：2018-03-04 17:20

本文选题：协议识别　切入点：网络特征　出处：《南京邮电大学》2014年硕士论文　论文类型：学位论文

【摘要】：随着计算机与互联网技术的飞速发展，协议识别技术对网络流量分类和管理显得尤为重要。伴随着新型协议的出现，传统的协议识别技术面临挑战，如何高效准确的识别各种协议是目前的研究热点。本文分析了传统协议识别的局限性，研究和提出以及实现了基于网络特征的协议识别方法。论文主要工作有： 1.本文在研究网络流属性的基础上，提取了四种网络属性，，包括载荷数据、数据包接受位置、数据包长度以及数据包方向，设计了18种网络特征，详细阐述设计、数据结构和算法； 2.在网络特征的基础上设计网络特征算法，构建协议模型库，提出了基于相对熵算法的协议识别方法； 3.考虑到时间和空间复杂度的问题，将决策树分类算法应用于构造每种协议的网络特征，提出了基于决策树算法的协议模型库优化方法； 4.实现了基于网络特征的协议识别技术的识别引擎。本文提出的协议识别技术在准确性和性能方面相比传统协议识有较大的提高，研究成果已用于实际之中。
[Abstract]:With the rapid development of computer and Internet technology, protocol identification technology is particularly important for network traffic classification and management. With the emergence of new protocols, the traditional protocol recognition technology is facing challenges. How to identify all kinds of protocols efficiently and accurately is a hot research topic at present. This paper analyzes the limitation of traditional protocol recognition, studies and proposes and implements a protocol recognition method based on network features. The main work of this paper is as follows:. 1. On the basis of studying the properties of network flow, this paper extracts four kinds of network attributes, including load data, data packet acceptance position, packet length and packet direction, designs 18 network features, and describes the design in detail. Data structure and algorithm; 2. Based on the network features, the network feature algorithm is designed, the protocol model library is constructed, and the protocol recognition method based on the relative entropy algorithm is proposed. 3. Considering the complexity of time and space, the decision tree classification algorithm is applied to construct the network features of each protocol, and a protocol model base optimization method based on decision tree algorithm is proposed. 4. The recognition engine of protocol recognition technology based on network features is implemented. Compared with the traditional protocol recognition, the proposed protocol recognition technology in this paper is more accurate and better than the traditional protocol recognition technology, and the research results have been used in practice.
【学位授予单位】：南京邮电大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.06

【参考文献】