Bitstream Protocol Classification Mechanism Based on Feature Extraction
Wei Wang, Binbin Bai, Yichuan Wang, Xinhong Hei, Li Zhang · 2019
In recent years, with the continuous expansion of network communication scale, the types of niche protocols and various proprietary communication protocols are increasing day by day, but botnet and various network attacks have also emerged in endlessly. However, most of the commonly used network protocol recognition software uses a single method, and can only identify specific network data packets or data streams, the degree of automation is low, and the recognition accuracy is not high. In view of the above situation, this paper takes the bit flow protocol data frame as the research object, takes the multi-protocol recognition as the goal, and carries on the protocol feature recognition by comparing the data flow characteristics and the evaluation index. The features of the protocol to be detected are compared with the existing protocol features of the feature base, and the similarity between each protocol is judged. The extracted composite features are digitalized to generate 0-1 matrix, and clustering analysis is completed. The frame vector quantification algorithm of message data is designed and implemented to improve the clustering efficiency. The experimental results show that, compared with the traditional algorithm, the protocol eigenvector algorithm improves the accuracy by 15%, which can make the unknown protocol format be generated faster.