Network protocol identification method and system based on semi-supervised learning

Abstract

The invention discloses a network protocol identification method and system based on semi-supervised learning, relating to the technical field of network safety. The method comprises the following steps of: training a plurality of classifiers based on a semi-supervised learning method; carrying out split-flow treatment on a network flow rate to be identified, and counting a single flow to be identified, which is obtained by the split-flow treatment, so as to obtain length information of a pre-set quantity of network packets in each single flow to be identified; and utilizing the classifiers to carry out protocol identification on the single flow to be identified according to the length information of the pre-set quantity of the network packets in the single flow to be identified. According to the network protocol identification method and system based on the semi-supervised learning, disclosed by the invention, a semi-supervised machine learning method is introduced into the protocol identification, namely that less calibrated sample information is used and a lot of unlabelled information is sufficiently utilized, so that the classification performance and the practical expansibility are met simultaneously; and the network protocol identification method and system have higher identification accuracy and higher identification speed, and can identify an encrypted protocol without depending on a lot of calibration data sets.

Description

Technical field [0001] The invention relates to the field of network security technology, and in particular to a network protocol identification method and system based on semi-supervised learning. Background technique [0002] Network application layer protocol identification technology, referred to as protocol identification, is a key component and core technology of security gateway systems such as Deep Inspection Firewall (deep inspection firewall), NIDS / NIPS (network intrusion detection / prevention system), and UTM (unified threat management). It is also the basic technology for operators to conduct traffic statistics and billing management. [0003] Protocol identification technology mainly relies on identification and judgment based on certain characteristics of network traffic to infer the protocol type to which the traffic belongs. Its core technical points include: the selection of features used for identification, and the method of using features for identificatio...

AI Technical Summary

Problems solved by technology

These methods either use unsupervised machine learning or supervised machine learning, either cannot accurately classify, or rely on a large number of calibrated data sets

But there is currently no published method that satisfies all practical needs

Images