A fast format classification and parsing approach based on multiple progressive resolution
Qiu Gongda, Xiangning Hao, Hui Shi, Liqiong Deng · 4th International Conference on Information Science, Electrical, and Automation Engineering (ISEAE 2022) · 2022
Aiming at the problems of low efficiency and low accuracy of protocol analysis in the actual network environment with large real-time traffic and wide use of unknown protocols, we propose a novel fast format classification and parsing approach based on multiple progressive resolution (FCPMPR). Firstly, binary message is scanned by experience window, and the message is compressed by distribution entropy and word frequency. Secondly, for avoiding excessive information loss caused by dimensionality reduction, the Simhash algorithm is adjusted to map the indefinite length packets to fixed-length fingerprint. And the rapid classification of packets is realized by fingerprint distance. Then in the same type of message, a domain-supported dynamic time warping (DDTW) algorithm is proposed to match the message feature structure with different protocols and marking density centers. Finally, the over-divided feature structures are combined to realize structure and state words recognition. Experiments show that the proposed algorithm achieves both accuracy and time complexity effectively based on multi-layer progressive method.