A protocol identification method and system

Abstract

The invention discloses a protocol identification method and a protocol identification system, wherein the method comprises the following steps: receiving a data flow of a protocol to be identified, wherein the data flow comprises an uplink data packet and a downlink data packet; splicing the uplink data packet and the downlink data packet and performing format conversion so as to obtain a load data flow, the format of which is converted; and performing protocol identification of the load data flow by adopting a depth learning model so as to obtain a protocol identification result of the data flow for output, wherein the depth learning model is a model obtained by adopting a train data flow in advance and used for identifying a network data flow. The method disclosed by the invention is free from artificial characteristic screening; the protocol identification rate of the network data flow can be increased better; and simultaneously, the cost is reduced.

Description

technical field [0001] The invention relates to the field of communication technology, in particular to a protocol identification method and system. Background technique [0002] Protocol identification refers to inferring the protocol type of network traffic based on the network flow and the data information in the flow. The existing protocol identification methods include: port-based, static feature-based and statistical feature-based protocol identification methods. [0003] The port-based protocol identification method mainly identifies the protocol label of the current data flow according to some well-known ports. For example, HTTP (HyperText Transfer Protocol, hypertext transfer protocol) uses port 80, and port 21 is dedicated to FTP (File Transfer Protocol, file transfer protocol) servers, etc. In actual use, this method has very limited ability to identify, and cannot do anything about registration and dynamic ports. [0004] The protocol identification method bas...

AI Technical Summary

Problems solved by technology

However, the disadvantage of this method is: the coverage of feature rules is not complete, and it is difficult to match emerging features

[0005] The recently applied protocol identification method based on statistical features is mainly a method of identifying protocols combined with machine learning algorithms. Compared with port protocol identification and static feature protocol identification, this method has better improvement. The selection of features mainly relies on manual screening, which is costly and very inefficient

Images