An Extraction Method of Unknown Protocol Features

Abstract

The invention discloses a method for extracting features of an unknown protocol, which randomly divides the data frame of each protocol into two parts, divides each part into bytes, and counts the number and frequency of occurrence of each byte. Obtain frequent bytes; filter the frequent bytes to obtain the frequent bytes corresponding to each protocol; splice the consecutive frequent bytes corresponding to a protocol to obtain the characteristic long string, that is, the frequent string, and filter to obtain each A feature candidate set of a protocol; characterize the data frame of the protocol as a vector according to the feature candidate set; use the correlation feature selection CFS algorithm for feature selection on the feature candidate set, and record the selected features; use the KNN algorithm to perform feature selection Classify, and count the classification accuracy and recognition rate. The invention provides a method for extracting features of an unknown protocol, which helps decision makers to identify the unknown protocol efficiently.

Description

technical field [0001] The invention relates to a method for extracting unknown protocol features. Background technique [0002] With the increasingly complex development of the network, ensuring the security of the information network has become the core content of the national informatization strategy; in a specific network environment, the threat of stealing secrets through special means is becoming more and more serious, and such secret stealing channels are usually through wireless communication In addition, the protocols used in such communication are all unconventional dedicated unknown protocols, and the existing preventive measures are basically only for known protocols, most of which are based on port mapping or static feature matching, which cannot Monitoring and detection of similar stealing channels and models. [0003] In order to ensure the safe operation of the network and the early warning of attacks and harmful behaviors, decision makers urgently need to a...

AI Technical Summary

Problems solved by technology

[0002] With the increasingly complex development of the network, ensuring the security of the information network has become the core content of the national informatization strategy; in a specific network environment, the threat of stealing secrets through special means is becoming more and more severe, and such stealing channels are usually through wireless communication In addition, the protocols used in this kind of communication are all unconventional dedicated unknown protocols, and the existing preventive measures are basically only for known protocols, most of which are based on port mapping or static feature matching. Monitoring and detection of stealth-like channel models

Images