流数据协议特征分析

发布时间：2018-11-09 16:32

【摘要】：近年来,网络信息安全与防护已经成为一个不容忽视的问题,保护网络信息安全也是国家信息化所要面临的主要问题。在某些特别的环境下,通过各种手段使用非常规的专用未知协议进行窃密的行为日益普遍,危害日趋严重：与此同时,从获取的流数据中对未知协议进行分析识别,应用通行的监测手段和协议分析与识别方法并不能很好的达到预期效果。流数据是一连串高速传送、无限长度(随时问增加)、顺序不可逆的数据序列。本文所讲述的流数据是数据链路层上的流数据(即二进制0、1代码)。因为数据链路层流数据即比特流并没有语义且单一,目前研究者多从应用层入手考虑,而对于数据链路层上的二进制流数据的协议识别则研究较少,所以对于二进制流数据的协议特征分析并没有很好的解决办法。随着网络协议的发展,协议识别呈现出新的特点,比如某些协议进行了加密、使用动态形式的端口、还有采用P2P方式。为了达到网络信息安全的目标,并能够及时对危险进行预警,当前急切的需要能够在如此复杂的网络环境下研究出一种能够对未知协议进行分析识别的、效率高的、准确率高的方法。在网络的现实复杂情况下,流数据协议特征分析成为一个新的研究领域。本文通过对已知协议和未知协议的分析与识别方法的研究,认为流数据的未知协议的特征也有其固定的特点和规律,当截获大量、快速、连续到达的数据序列时,就可以通过实施一定的技术手段和方法对其进行分析和识别,找到其中所蕴含的规律信息。从海量的流数据中分析和识别未知协议的方法就是要对数据进行挖掘,找寻其中所包含的特征序列,在没有经验和已知协议的特征序列对照的情况下,达到对频繁序列的快速提取。本课题的内容是：首先对数据链路层上传输的流数据(二进制)进行合理的帧切分,而后选择合适的标识和特征选择算法,其次验证所用算法在协议识别中的效果,最后筛选出能准确描述协议的指纹信息。针对以上步骤,本文基于聚类算法对数据帧进行聚类操作,并且设计了一个无监督的基于最小冗余最大相关的特征选择算法提取数据帧的特征。本课题的研究正式基于这样的依据,针对大量、快速、连续到达的数据序列的分析提出一种可行的、效率高的、误报率低的协议分析与识别方法,保障网络甄别未知协议的能力。
[Abstract]:In recent years, network information security and protection has become a problem that can not be ignored, and the protection of network information security is also the main problem to be faced by national informatization. In some special environments, the use of unconventional private unknown protocols to steal secrets is becoming more and more common and harmful: at the same time, the unknown protocols are analyzed and identified from the acquired stream data. The application of common monitoring methods and protocol analysis and identification methods can not achieve the desired results. Stream data is a series of high-speed transmission, infinite length (increase at any time), order irreversible data sequence. The stream data described in this article is the stream data on the data link layer (i.e. binary 0 / 1 code). Because the data link laminar flow data, namely bit stream, is not semantic and single, at present, researchers mostly consider it from the application layer, but there is little research on the protocol recognition of binary stream data on the data link layer. So the protocol feature analysis of binary stream data is not a good solution. With the development of network protocols, protocol identification presents new features, such as encryption of some protocols, the use of dynamic ports, and the use of P2P. In order to achieve the goal of network information security, and to be able to warn the danger in time, the urgent need is to develop an efficient and efficient way to analyze and identify unknown protocols in such a complex network environment. A method with high accuracy. In the complex situation of network, the feature analysis of stream data protocol becomes a new research field. Based on the analysis and identification of known and unknown protocols, this paper holds that the characteristics of unknown protocols for stream data also have their fixed characteristics and rules, when a large number of fast and continuous data sequences are intercepted. It can be analyzed and identified by implementing certain technical means and methods, and the law information contained therein can be found. The method of analyzing and identifying unknown protocols from massive stream data is to mine the data and find the feature sequences contained therein, without comparing the feature sequences with those of known protocols. Fast extraction of frequent sequences is achieved. The contents of this thesis are as follows: firstly, the stream data (binary) transmitted on the data link layer is segmented reasonably, then the appropriate identification and feature selection algorithms are selected, and then the effectiveness of the proposed algorithm in protocol recognition is verified. Finally, the fingerprint information which can accurately describe the protocol is selected. In view of the above steps, this paper uses the clustering algorithm to cluster the data frames, and designs an unsupervised feature selection algorithm based on minimum redundancy and maximum correlation to extract the features of the data frames. Based on this basis, a feasible, efficient and low false alarm rate protocol analysis and recognition method is proposed for the analysis of a large number of fast, continuous arrival data sequences. The ability of the network to identify unknown protocols.
【学位授予单位】：电子科技大学
【学位级别】：硕士
【学位授予年份】：2016
【分类号】：TN915.04

【相似文献】