Protocol format automatic inference method and system based on relation inference

Abstract

The invention discloses a protocol format automatic inference method and system based on relation inference. The method comprises three stages, namely a coarse-grained structure generation stage, a relation learning stage and a fine-grained structure generation stage. The coarse-grained structure generation stage comprises the following steps of: preprocessing original network traffic; generating a frequency dictionary for a preprocessed effective load set; and generating a coarse-grained structure according to the frequency dictionary. The relation learning stage comprises the following steps of: extracting the characteristics of the effective load; generating a corresponding question set and an answer set for the load coarse-grained structure; and reasoning a logic relationship between n-grams in the effective load characteristics by using the questions and answers, and constructing a field relationship model. The fine-grained structure generation stage comprises the following steps of: mapping a field relation model into a coarse-grained structure according to the field relation model obtained in the relation learning stage; and deducing the format of the load according to the mapping relation. According to the protocol format automatic inference method, the accurate protocol format is extracted from the variable-length fields in the TCP/UDP load, and the extraction method is high in efficiency and strong in robustness.

Description

technical field [0001] The invention relates to automatic extraction of unknown network traffic formats using deep learning technology according to data packet TCP / UDP payloads, in particular to a method and system for automatically inferring protocol formats based on relational reasoning. Background technique [0002] Network protocol format extraction is the process of extracting the key information of the TCP / UDP payload in the traffic, which is an important challenge in the field of network security. It has a wide range of applications in the field of computer network and network security. For example, intrusion detection and prevention systems (IDSes / IPSes), network monitoring, network measurement, tunnel detection, traffic classification, etc. Specifically, in the field of network security, many security analyzes such as static / symbolic vulnerability scanning, vulnerability exploitation, attack detection, and malware behavior analysis require accurate modeling of netw...

AI Technical Summary

Problems solved by technology

However, existing designs based on the above two methods have limitations respectively:

Existing techniques do not model this uncertainty and thus often produce incorrect results

Images