Protocol keyword identification method based on lexicographic tree pruning search

Abstract

The invention discloses a protocol keyword identification method based on lexicographic tree pruning search. The method comprises: firstly acquiring a to-be-identified data flow, saving data of the data flow into a circular queue buffer, screening character strings in the buffer, and generating branches of a lexicographic tree; in each lexicographic tree branch generation process, computing a pruning threshold of each node when pruning conditions are met, pruning the lexicographic tree, and finally acquiring a purify rate; and according to the purify rate, obtaining keywords, thereby completing keyword identification. According to the protocol keyword identification method based on the lexicographic tree pruning search, by importing a lexicographic tree pruning algorithm, a defect that the used storage space is oversize when protocol keyword identification is performed by using the traditional lexicographic tree algorithm is solved, and an advantage of improving the space utilization efficiency is achieved; and the use value is better.

Description

technical field [0001] The invention relates to a keyword recognition technology, in particular to a protocol keyword recognition method based on dictionary tree pruning search. Background technique [0002] Protocol reverse engineering refers to extracting protocol syntax, semantics, and workflow by monitoring and analyzing information such as network input and output, system behavior, and instruction execution flow of protocol entities without relying on protocol descriptions. Protocol reverse is divided into format reverse and state machine reverse. In format reverse engineering, identifying and extracting keywords in the protocol is a basic and important task. The keyword of the protocol refers to the information that plays a key role in the control of the communication stipulated by the protocol specification in the protocol transmission unit, that is, the message, and generally appears frequently in the communication data flow. There are mainly the following methods ...

AI Technical Summary

Problems solved by technology

[0012] The technical problem solved by the present invention is: to overcome the deficiencies of the prior art, to provide a protocol keyword recognition method based on dictionary tree pruning search, and to solve the existing problems caused by using traditional dictionary tree to mine protocol keywords. The problem that the storage space is too large and the length of the protocol feature word is fixed affects the accuracy of the analysis, so as to improve the efficiency and applicability of the protocol keyword recognition

Images