Method for extracting unknown protocol features

Abstract

The invention discloses a method for extracting unknown protocol features. The method includes: the data frames of each kind of protocol are divided into two parts, each part is segmented according to bytes, and occurrence times and frequencies of each byte are counted to obtain frequent bytes; the frequent bytes are screened to obtain the frequent bytes corresponding to each kind protocol; splicing the frequent bytes, which occurs continuously, corresponding to each kind protocol to obtain feature long strings, namely frequent strings, and the frequent strings are screened to obtain the feature candidate set of each kind of protocol; the data frames of each kind of protocol are represented into vectors according to the corresponding feature candidate set; a correlative feature selecting CFS algorithm is used to perform feature selection on each feature candidate set, and the selected features are recorded; a KNN algorithm is used to categorize the features, and categorizing accuracy rate and recognition rate are statistically counted. By the method for extracting unknown protocol features, decision makers can effectively recognize unknown protocols.

Description

technical field [0001] The invention relates to a method for extracting unknown protocol features. Background technique [0002] With the increasingly complex development of the network, ensuring the security of the information network has become the core content of the national informatization strategy; in a specific network environment, the threat of stealing secrets through special means is becoming more and more serious, and such secret stealing channels are usually through wireless communication In addition, the protocols used in such communication are all unconventional dedicated unknown protocols, and the existing preventive measures are basically only for known protocols, most of which are based on port mapping or static feature matching, which cannot Monitoring and detection of similar stealing channels and models. [0003] In order to ensure the safe operation of the network and the early warning of attacks and harmful behaviors, decision makers urgently need to a...

AI Technical Summary

Problems solved by technology

[0002] With the increasingly complex development of the network, ensuring the security of the information network has become the core content of the national informatization strategy; in a specific network environment, the threat of stealing secrets through special means is becoming more and more severe, and such stealing channels are usually through wireless communication In addition, the protocols used in this kind of communication are all unconventional dedicated unknown protocols, and the existing preventive measures are basically only for known protocols, most of which are based on port mapping or static feature matching. Monitoring and detection of stealth-like channel models

Images