Bit error rate model-based unknown communication protocol identification method

Abstract

The invention discloses a bit error rate model-based unknown communication protocol identification method. According to the method, a multi-pattern matching algorithm and an association rule analysis algorithm are combined together to extract the protocol feature string of known protocols, so that a protocol feature library is constructed; when a protocol type adopted by identified data is identified, the maximum number of bit errors allowed by the identified data is calculated; a fuzzy matching algorithm is used to extract the feature string of the identified data within the range of the number of the bit errors; and the protocol type adopted by the identified data is obtained through automatic reasoning. Therefore, the identification method can improve a data identification rate and has a good identification effect for data having error codes.

Description

technical field [0001] The invention belongs to the technical field of computer network security, and more specifically relates to an unknown communication protocol identification method based on a bit error rate model. Background technique [0002] With the rapid development of communication technology, network communication has become the main way of communication in people's daily life, followed by more and more serious network information security problems. For traditional network security technology, it can only solve part of the problem, and accurately identifying the protocol used by communication data is of great significance to overcome the defects of traditional network security technology. Premises and foundations of behavior. At present, network protocol identification technology has been developed and applied rapidly, mainly including identification based on port, flow characteristics and load behavior. The identification technology based on well-known port nu...

AI Technical Summary

Problems solved by technology

However, there are often frame errors in the actual data transmission process. For example, in the wireless communication process, the following reasons may cause frame errors: 1. When the received signal is weak

2. When the pilot frequency is polluted

4. When it is impossible to switch in the switching area

That is, in the worst case, the data frame will have a probability of 0.4‰ being unrecognizable and discarded

Especially for the fields of national defense security and military confrontation, this accuracy is far from meeting the demand

[0004] Based on the above analysis, when the bit error happens to exist in the protocol signature string of the data, the accurate identification system based on multi-pattern matching and other methods often cannot identify the data, and thus discards the bit error data without doing anything. leading to a decrease in the data recognition rate

Images