Network message matching method of custom protocol application layer based on K-nearest neighbor

Abstract

The invention provides a network message matching method of a custom protocol application layer based on K-nearest neighbor, and belongs to the field of data transmission. The method comprises the following steps: constructing a protocol type storage structure according to historical network messages, carrying out sequential numbering according to timestamps, obtaining a structure feature value and a value array of each protocol type, obtaining prediction protocols of K neighbors based on a K neighbor model, inputting the prediction protocols and feature values into a linear regression equation, and carrying out linear regression on the prediction protocols of K neighbors according to the linear regression equation; obtaining similar weights of a to-be-matched protocol and K prediction protocols, sorting the similar weights, obtaining a source IP and a destination IP of a to-be-matched message, querying corresponding protocol types, and forming U with the prediction protocols; matching the network message to be matched with the protocol in the U one by one, and when the matching is successful, transmitting data and returning a protocol type; and when the matching fails, the local protocols except the U are polled and matched until the matching is correct. According to the invention, the data transmission efficiency is improved while the transmission reliability and security are ensured.

Description

technical field [0001] The invention belongs to the field of message matching, and in particular relates to a network message matching method based on a K-nearest neighbor self-defined application layer. Background technique [0002] The internet uses multiple layers of protocol stacks for data transmission. With the complexity of the network, especially in some special scenarios, in order to ensure the security and efficiency of communication, the application layer protocol is usually customized and used as the communication carrier to transmit data. Although the custom application layer protocol has the characteristics of flexibility, it also brings difficulties to the protocol matching of network packets. Due to the standardization and stability of the protocol, the traditional transport layer protocol can be identified simply by the protocol number. Since the custom protocol is not standardized and unstable, it is possible to delete the old protocol or add a new protoc...

AI Technical Summary

Problems solved by technology

However, the method of polling for matching local protocols needs to traverse the local protocols, which takes a long time and has low performance

Images