抗噪的未知应用层协议报文格式最佳分段方法

发布时间：2018-06-23 09:04

本文选题：应用层协议 + 报文格式　；参考：《软件学报》2013年03期

【摘要】：为了自动解析未知应用层协议的报文格式,提出一种未知应用层协议报文格式的最佳分段方法.这种方法不需要关于未知应用层协议的先验知识.它首先建立一种用于最佳分段的隐半马尔可夫模型(HSMM),并利用未知应用层协议在网络会话过程中传输的报文序列样本集来估计该模型的参数;再通过基于HSMM的最大似然概率分段方法,对报文中的各个字段进行最佳划分,同时获取代表各个字段语义的关键词.这种方法并不要求训练集绝对纯净.它能够基于观测序列的似然概率分布,发现混杂在训练集中的其他协议数据(噪声)并进行有效过滤.实验结果表明,该方法能够解析文本和二进制协议的报文格式,依据关键词构建的协议识别特征有很高的准确识别率,并能有效地检测出噪声.
[Abstract]:In order to automatically resolve the message format of unknown application layer protocol, an optimal segmentation method of unknown application layer protocol packet format is proposed. This method does not require prior knowledge of unknown application layer protocols. Firstly, a hidden semi-Markov model (HSMM) for optimal segmentation is established, and the parameters of the model are estimated by using the sample set of packets transmitted by unknown application layer protocol in the course of network session. Then, by using the maximum likelihood probability segmentation method based on HSMM, each field in the packet is best partitioned, and the key words representing the semantics of each field are obtained at the same time. This method does not require absolute purity of the training set. Based on the likelihood probability distribution of the observation sequence, it can find other protocol data (noise) mixed in the training set and filter them effectively. The experimental results show that the proposed method can resolve the message format of the text and binary protocols, and the protocol features constructed according to the key words have a high accuracy recognition rate, and can effectively detect the noise.
【作者单位】：中山大学电子与通信工程系;
【基金】：国家自然科学基金(60970146),国家自然科学基金-广东联合基金(U0735002) 国家高技术研究发展计划(863)(2007AA01Z449)
【分类号】：TP393.08

【二级参考文献】