Network traffic based security protocol semantic level format parsing method and system

Abstract

The application discloses a network flow-based security protocol semantic-level format analysis method and system, wherein the method comprises the following steps: data preprocessing: preprocessing original flow data packets to obtain a message sequence of a single protocol type; plaintext domain and ciphertext domain division: calculating the information entropy of the message sequence byte by byte, and dividing the message into the plaintext domain and the ciphertext domain based on the information entropy; dynamic domain and static domain division: replacing the ciphertext domain bytes, encoding the plaintext domain bytes according to the offset, generating two-direction message groups, and dividing the dynamic domain and the static domain by mining closed frequent sequences; length domain key field identification: generating a length domain value candidate set according to the domain division result, and performing cyclic comparison with the byte slice value to identify the length domain key field; semantic identification of other key fields: based on a heuristic strategy and closed frequent sequences, the semantics of other key fields in the message are identified, and the semantic level format of the security protocol is output.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network information security, and particularly relates to a security protocol semantic level format analysis method and system based on network traffic. BACKGROUND

[0002] In recent years, with the increasing awareness of personal privacy protection, the application of security protocols such as IPsec, PGP, HTTPS, FTPS, etc. for data communication in the network is increasing, in addition, military communication systems and many malicious codes will use unknown cryptographic protocols for secure communication.

[0003] Security protocols are network communication protocols used for security and privacy, which protect user communication by using data encryption, digital signature, integrity check and other technologies. It is usually divided into two stages: handshake stage, in which the communication parties need to establish a connection, authenticate identity, negotiate encryption algorithm, etc.; transmission stage, in which the communication parties need to encrypt data according to the encryption algorithm negotiated in advance, and sometimes generate an information digest to ensure integrity and non-repudiation, which is attached to the message and sent together with the message. Compared with traditional network communication protocols, security protocols have the characteristics of complex message structure, multiple cipher text fields, and multiple length fields.

[0004] Protocol format inference methods are mainly divided into two categories: network traffic-based analysis methods and execution trace-based analysis methods. The former captures protocol network data packets, analyzes the value change rate of byte streams to infer features, and then obtains the protocol format, but it is generally used for reverse analysis of plaintext communication protocols, and security protocols cannot directly apply this method due to their own characteristics; the latter uses dynamic analysis technology to track the protocol packet parsing process of the program, and analyzes the program execution trace to extract the protocol format.

[0005] Currently, there are some security protocol format inference methods based on execution traces, but they require protocol communication software and involve complex binary program analysis techniques. In addition, there are also some security protocol reverse methods based on network traffic, such as the SPFPA method proposed by Zhu et al. which identifies and locates encrypted fields, and the method proposed by He et al. which uses network traces and a greedy algorithm to realize the analysis of security protocols, but there are still the following problems:

[0006] (1) The format extraction algorithm for protocol reverse usually uses a frequent pattern-based method, which is very sensitive to location information and requires strict requirements for the appearance position of protocol constants, making it difficult to be directly applied to security protocols with complex variable length fields;

[0007] (2) There is no identification of multi-length fields of the protocol, the security protocol structure is complex, and there can be multiple sub-protocols in the message because there are multiple length fields indicating different fields;

[0008] (3) No semantic identification is performed for the key fields specific to the security protocol, such as the encryption suite, encryption algorithm and the like fields transmitted by the security protocol in the key agreement process. SUMMARY

[0009] The present application provides a security protocol semantic-level format analysis method and system based on network traffic, which mainly solves the following technical problems:

[0010] (1) For the problem that frequent patterns cannot be directly applied to security protocols with complex structure and many edge length fields, the present application divides the fields of the message into two stages, divides the plaintext fields and the ciphertext fields using information entropy, then replaces and encodes the message bytes, uses a closed frequent pattern mining algorithm to improve efficiency, mines closed frequent sequences, and divides dynamic fields and static fields;

[0011] (2) For the problem that there is currently a lack of multi-length field identification for security protocols, the present application generates a length field value candidate set using the field division results of the security protocol, and realizes multi-length field identification of the security protocol in combination with a cyclic comparison algorithm;

[0012] (3) For the problem that there is a lack of semantic inference of the key fields specific to the security protocol, the present application designs a heuristic strategy in combination with the characteristics of the key fields of the security protocol and the knowledge of cryptography, and identifies the key fields specific to the security protocol in combination with the closed frequent sequences in the two-direction message groups.

[0013] The technical solutions adopted by the present application are as follows:

[0014] A security protocol semantic-level format analysis method based on network traffic, comprising the following steps:

[0015] S1. Data preprocessing: preprocessing the original traffic data packet to obtain a message sequence of a single protocol type;

[0016] S2. Division of plaintext fields and ciphertext fields: calculating the information entropy of the message sequence byte by byte, and dividing the message into plaintext fields and ciphertext fields based on the information entropy;

[0017] S3. Division of dynamic fields and static fields: replacing the ciphertext field bytes, encoding the plaintext field bytes according to the offset, generating two-direction message groups, mining closed frequent sequences, and dividing dynamic fields and static fields;

[0018] S4. Identification of length field key fields: generating a length field value candidate set according to the field division results, and performing cyclic comparison with the byte slice value to identify the length field key fields;

[0019] S5. Other key field semantic identification: based on the heuristic strategy and the closed frequent sequence obtained in step S3, other key fields in the message are identified semantically, and the semantic level format of the security protocol is output.

[0020] Further, in step S1, after obtaining the original traffic data packet, packet filtering and repeated deletion are performed to obtain a single protocol type traffic sample, and then the packets are constructed into different sessions according to a time threshold, and the same offset messages in the session belong to the same type of protocol message.

[0021] Further, step S2 includes the following sub-steps:

[0022] S201. Using the entropy value calculation formula Where x i is the byte offset in the message, f k is the probability of the byte value k at the offset position, the information entropy entropy[0], entropy[1], entropy[2]...entropyp[i]...entropy[N] of the message sequence is calculated byte by byte, where N+1 is the number of messages;

[0023] S202. Compare the information entropy entropyp[i] with the entropy threshold H N (p) of the ciphertext information, and judge the plaintext and ciphertext attributes of the byte;

[0024] S203. Merge the same attribute bytes of the continuous offset, and divide the message into plaintext domain and ciphertext domain.

[0025] Further, step S3 includes the following sub-steps:

[0026] S301. Replace the ciphertext domain with special characters, and encode the plaintext domain byte by offset;

[0027] S302. Generate vertical message groups and horizontal message groups according to the session logic and time sequence relationship of the message;

[0028] S303. Use the BIDE algorithm to mine closed frequent sequences in the vertical message groups and the horizontal message groups respectively;

[0029] S304. Divide the plaintext domain into dynamic domain and static domain according to the closed frequent sequences of the vertical message groups, and output the domain division result.

[0030] Further, step S4 includes the following sub-steps:

[0031] S401. Generate length domain value candidate set according to the domain division result;

[0032] S402. Slice the static field and the dynamic field by 1-4 bytes respectively and calculate the values;

[0033] S403. Compare the length field value candidate set with the byte slice value cyclically, and add the intersection to the possible length field key field set;

[0034] S404. Cyclically judge whether the possible length field key field set meets the heuristic strategy of the length field key field, and judge it as the length field key field if it meets.

[0035] A network traffic-based security protocol semantic-level format parsing system, comprising:

[0036] A data preprocessing module configured to preprocess original traffic data packets to obtain a message sequence of a single protocol type;

[0037] A plaintext field and ciphertext field division module configured to calculate the information entropy of the message sequence byte by byte, and divide the message into a plaintext field and a ciphertext field based on the information entropy;

[0038] A dynamic field and static field division module configured to replace the ciphertext field bytes, encode the plaintext field bytes according to the offset, generate two-direction message groups, and mine closed frequent sequences to divide the dynamic field and the static field;

[0039] A length field key field identification module configured to generate a length field value candidate set according to the domain division result, and cyclically compare the byte slice value to identify the length field key field;

[0040] A semantic identification module of other key fields configured to perform semantic identification on other key fields in the message based on the heuristic strategy and the closed frequent sequences obtained by the dynamic field and static field division module, and output the semantic-level format of the security protocol.

[0041] Further, in the data preprocessing module, after obtaining the original traffic data packets, packet filtering and repeated deletion are performed to obtain traffic samples of a single protocol type, and then the packets are constructed into different sessions according to a time threshold, and the same offset messages in the session belong to the same type of protocol message.

[0042] Further, the plaintext field and ciphertext field division module is configured to use an entropy value calculation formula where x i is the byte offset in the message, and f kThe information entropy entropy[0], entropy[1], entropy[2]...entropyp[i]...entropy[N] of the message sequence is calculated byte by byte for the occurrence probability of the byte of the offset position taking value k, wherein N+1 is the number of messages; the information entropy entropyp[i] is compared with the entropy threshold H of the ciphertext information N (p) comparing and judging the plaintext and ciphertext attributes of the byte; merging the same attribute bytes of continuous offsets, and dividing the messages into the plaintext domain and the ciphertext domain.

[0043] Further, the dynamic domain and static domain division module is configured to replace the ciphertext domain with special characters, and to perform offset coding on the plaintext domain byte; generating the vertical direction message group and the horizontal direction message group according to the session logic and the time sequence relationship of the message; mining the closed frequent sequence on the vertical direction message group and the horizontal direction message group respectively using the BIDE algorithm; dividing the plaintext domain into the dynamic domain and the static domain according to the closed frequent sequence of the vertical direction message group, and outputting the domain division result.

[0044] Further, the length domain key field identification module is configured to generate a length domain value candidate set according to the domain division result, to slice and calculate the value of the static domain and the dynamic domain by 1-4 bytes respectively, to compare the length domain value candidate set and the byte slice value cyclically, to add the intersection to the possible length domain key field set, to cyclically judge whether the possible length domain key field set meets the heuristic strategy of the length domain key field, and to judge that it is the length domain key field if it meets.

[0045] At present, there are many researches on protocol reverse, but most of these works are for non-encrypted protocols in the network, and in the current complex network environment, with the continuous enhancement of people's awareness of personal privacy protection, more and more unknown encrypted protocols are used in data communication in the network. The current research is also for the identification and positioning of the ciphertext payload, and lacks the semantic level reverse analysis of the security protocol.

[0046] The main analysis object of the application is the network traffic of the security protocol, the plaintext domain and the ciphertext domain are first divided by calculating the information entropy, then the closed frequent sequence is mined to divide the dynamic domain and the static domain, and on this basis, the semantics of the length domain and other key fields in the message are identified, and the semantic level reverse analysis of the security protocol is completed.

[0047] The application has the beneficial effects that:

[0048] (1) The traditional network traffic-based protocol reverse mainly uses the frequent item set-based format extraction algorithm, which is strict to the byte offset position, while the security protocol usually has complex format and multiple variable-length key fields, which cannot be directly used by the method. The application first divides the ciphertext domain of the message by calculating the information entropy, then mines the closed frequent sequence, divides the dynamic domain and the plaintext domain, and outputs the domain division result of the message; at the same time, considering that the ciphertext domain in the security protocol has no statistical characteristics, the byte sequence is replaced and encoded before mining the closed frequent sequence, and the efficient BIDE algorithm is selected, the pseudo-projection library is established for each prefix of the byte sequence, the BIDE algorithm is called circularly, the closed frequent sequence is obtained, and the dynamic domain and the static domain are divided.

[0049] (2) The application can identify multiple length domains in the message. The structure of the security protocol is more complex than the general communication protocol, and there are multiple variable-length key fields and ciphertext domains, so there are multiple length domains in the message. The application uses the domain division result of the previous stage, generates the possible value candidate set of the length domain according to the common length domain in the security protocol and the inline relationship rule of the message, and sequentially performs 1-4 byte length slice cutting value on the region where the length domain may exist. A circular comparison algorithm is designed to find the intersection of the possible value candidate set and the slice cutting value, and to locate various length domains in the message.

[0050] (3) The application performs semantic identification on other key fields, uses the closed frequent sequence obtained in the horizontal message group in the domain division stage, and combines the heuristic identification strategy to perform semantic identification on the key fields. In the domain division stage, the horizontal message group and the vertical message group are generated according to the logical relationship and the time sequence relationship of the session, the closed frequent sequence is mined in the two direction message groups respectively, the frequent sequence in the horizontal direction is applied in the semantic identification stage of the key field, and the semantic level protocol format of the security protocol is output. BRIEF DESCRIPTION OF DRAWINGS

[0051] Figure 1 is a network traffic-based security protocol semantic level format analysis method flowchart of embodiment 1 of the application. DETAILED DESCRIPTION

[0052] In order to have a more clear understanding of the technical features, purposes and effects of the application, the specific embodiments of the application will be described. It should be understood that the specific embodiments described herein are only used to explain the application, and are not used to limit the application, that is, the described embodiments are only a part of the embodiments of the application, but not all the embodiments. Based on the embodiments of the application, all other embodiments obtained by those skilled in the art without creative labor are within the protection scope of the application.

[0053] EMBODIMENT 1

[0054] The embodiment provides a network traffic-based security protocol semantic-level format parsing method, which divides a protocol message into a ciphertext domain, a plaintext domain, a dynamic domain and a static domain by calculating information entropy of bytes and mining a closed frequent sequence, generates a length domain value candidate set according to a domain division result, performs semantic identification on a key field by using the closed frequent sequence in the domain division stage, and outputs a semantic-level format of a security protocol. Figure 1 As shown in the figure, the method comprises the following steps:

[0055] S1. Data preprocessing: preprocessing original traffic data packets to obtain a message sequence of a single protocol type;

[0056] S2. Plain text domain and ciphertext domain division: calculating information entropy of the message sequence byte by byte, and dividing the message into a plaintext domain and a ciphertext domain based on the information entropy;

[0057] S3. Dynamic domain and static domain division: replacing the ciphertext domain bytes, encoding the plaintext domain bytes according to an offset, generating two-direction message groups, and mining a closed frequent sequence to divide the dynamic domain and the static domain;

[0058] S4. Length domain key field identification: generating a length domain value candidate set according to the domain division result, and performing cyclic comparison with a byte slice value to identify the length domain key field;

[0059] S5. Semantic identification of other key fields: performing semantic identification on other key fields in the message based on a heuristic strategy and the closed frequent sequence obtained in step S3, and outputting a semantic-level format of a security protocol.

[0060] Preferably, in step S1, after obtaining the original traffic data packets, packet filtering and repeated deletion are performed to obtain a traffic sample of a single protocol type, and then the packets are constructed into different sessions according to a time threshold, and the same offset messages in the session belong to the same type of protocol message.

[0061] Preferably, step S2 comprises the following substeps:

[0062] S201. Using an entropy value calculation formula Where x i is the byte offset in the message, f k is the occurrence probability of the byte value k at the offset position, the information entropy of the message sequence entropy[0], entropy[1], entropy[2]...entropyp[i]...entropy[N] is calculated byte by byte, where N+1 is the number of messages;

[0063] S202. Comparing the information entropy entropyp[i] with an entropy threshold H N(p) performing a comparison to determine the plaintext or ciphertext property of the byte;

[0064] S203. Merging the continuous offset bytes of the same property and dividing the message into plaintext domain and ciphertext domain.

[0065] Wherein, the message can be regarded as a collection of a series of events (bytes), and each byte is regarded as an event, there are 256 possible states. Compared with plaintext data, the value state of ciphertext byte is uncertain, and is approximately random value. The information entropy can reflect the randomness degree of byte value and the distribution characteristics of bytes in the protocol sequence. The information entropy is widely used in the field of protocol traffic identification. Dorfinger et al. use information entropy to identify Skype protocol, and Zhang Yuchong et al. use information entropy as a measure of the degree of data stream encryption to realize a Trojan detection system based on data stream. Therefore, the information entropy is used to divide the plaintext domain and the ciphertext domain of the message in this embodiment.

[0066] Preferably, step S3 comprises the following sub-steps:

[0067] S301. Replacing the ciphertext domain with special characters and performing offset encoding on the plaintext domain bytes;

[0068] S302. Generating vertical message groups and horizontal message groups according to the session logic and timing relationship of the message;

[0069] S303. Mining closed frequent sequences in the vertical message groups and the horizontal message groups respectively using the BIDE algorithm;

[0070] S304. Dividing the plaintext domain into dynamic domain and static domain according to the closed frequent sequences of the vertical message groups, and outputting the domain division result.

[0071] Preferably, step S4 comprises the following sub-steps:

[0072] S401. Generating a length domain value candidate set according to the domain division result;

[0073] S402. Slicing the static domain and the dynamic domain by 1-4 bytes respectively and calculating the values;

[0074] S403. Comparing the length domain value candidate set with the byte slice values cyclically, and adding the intersection to the possible length domain key field set;

[0075] S404. Cyclically judging whether the possible length domain key field set meets the heuristic strategy of the length domain key field, and judging it as the length domain key field if it meets the heuristic strategy.

[0076] Embodiment 2

[0077] The embodiment provides a network traffic-based security protocol semantic-level format parsing system, which comprises:

[0078] A data preprocessing module is configured to preprocess original traffic data packets to obtain a message sequence of a single protocol type.

[0079] A plaintext domain and ciphertext domain division module is configured to calculate information entropy of the message sequence byte by byte, and divide the message into a plaintext domain and a ciphertext domain based on the information entropy.

[0080] A dynamic domain and static domain division module is configured to replace ciphertext domain bytes, encode plaintext domain bytes according to offsets, generate two-direction message groups, and mine closed frequent sequences to divide the dynamic domain and the static domain.

[0081] A length domain key field identification module is configured to generate a length domain value candidate set according to the domain division result, and perform cyclic comparison with byte slice values to identify length domain key fields.

[0082] A semantic identification module of other key fields is configured to perform semantic identification on other key fields in the message based on a heuristic strategy and the closed frequent sequences obtained by the dynamic domain and static domain division module, and output a semantic-level format of a security protocol.

[0083] Preferably, in the data preprocessing module, after obtaining the original traffic data packets, packet filtering and repeated deletion are performed to obtain traffic samples of a single protocol type, and then packets are constructed into different sessions according to a time threshold, and same offset messages in the session belong to the same type of protocol message.

[0084] Preferably, the plaintext domain and ciphertext domain division module is configured to use an entropy value calculation formula Where x i is a byte offset in the message, f k is the occurrence probability of the byte value k at the offset position, the information entropy entropy[0], entropy[1], entropy[2]...entropyp[i]...entropy[N] of the message sequence is calculated byte by byte, where N+1 is the number of messages; the information entropy entropyp[i] is compared with an entropy threshold H N (p) of the ciphertext information, the plaintext and ciphertext attributes of the byte are judged, the same attribute bytes of continuous offsets are combined, and the message is divided into the plaintext domain and the ciphertext domain.

[0085] Wherein, the message can be regarded as a collection of a series of events (bytes), and each byte is regarded as an event, then there are 256 possible states. Compared with the plaintext data, the value state uncertainty of the cipher text byte is larger, and is approximately random value. The information entropy can reflect the randomness degree of the byte value and the distribution characteristics of the byte in the protocol sequence. The information entropy is widely used in the protocol traffic identification field. Dorfinger et al. use the information entropy to identify the Skype protocol. Zhang Yuchong et al. use the information entropy as a measure of the encryption degree of data stream to realize a Trojan detection system based on data stream. Therefore, the embodiment uses the information entropy to divide the plaintext domain and the cipher text domain of the message.

[0086] Preferably, the dynamic domain and static domain division module is configured to replace the cipher text domain with special characters, and to perform offset encoding on the plaintext domain bytes; to generate vertical direction message groups and horizontal direction message groups according to the session logic and timing relationship of the message; to mine closed frequent sequences on the vertical direction message groups and the horizontal direction message groups respectively using the BIDE algorithm; and to divide the plaintext domain into the dynamic domain and the static domain according to the closed frequent sequences of the vertical direction message groups, and to output the domain division result.

[0087] Preferably, the length domain key field identification module is configured to generate a length domain value candidate set according to the domain division result, to slice the static domain and the dynamic domain by 1-4 bytes respectively and to calculate the values, to cyclically compare the length domain value candidate set with the byte slice values, to add the intersection to the possible length domain key field set, to cyclically judge whether the possible length domain key field set meets the heuristic strategy of the length domain key field, and to judge that it is the length domain key field if it meets.

[0088] It should be noted that, for the method embodiments described above, in order to facilitate description, they are expressed as a combination of a series of actions, but those skilled in the art should know that the present application is not limited to the order of the actions described, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

Claims

1. A network traffic based security protocol semantic level format parsing method, characterized by, The method comprises the following steps: S1. Data preprocessing: preprocessing the original traffic data packet to obtain a single protocol type message sequence; S2. Clear text field and cipher text field division: calculating the information entropy of the message sequence byte by byte, and dividing the message into clear text field and cipher text field based on the information entropy; S3. Dynamic field and static field division: replacing the cipher text field bytes, encoding the clear text field bytes according to the offset, generating two-direction message groups, and mining closed frequent sequences to divide the dynamic field and the static field; S4. Length field key field identification: generating a length field value candidate set according to the domain division result, and performing cyclic comparison with the byte slice value to identify the length field key field; S5. Semantic identification of other key fields: based on the heuristic strategy and the closed frequent sequences obtained in step S3, the semantics of other key fields in the message are identified, and the semantic level format of the security protocol is output; the heuristic strategy is a strategy formed by combining the characteristics of the security protocol key field and the knowledge of cryptography; Step S3 comprises the following sub-steps: S301. Replace the cipher text field with special characters, and encode the clear text field bytes according to the offset; S302. According to the session logic and time sequence relationship of the message, generate vertical direction message groups and horizontal direction message groups; S303. Use the BIDE algorithm to mine closed frequent sequences in the vertical direction message groups and the horizontal direction message groups respectively; S304. Divide the clear text field into dynamic field and static field according to the closed frequent sequences of the vertical direction message groups, and output the domain division result.

2. The method of claim 1, wherein the network traffic based security protocol semantic level format parsing method is characterized by, In step S1, after obtaining the original traffic data packet, group filtering and repeated deletion are performed to obtain a single protocol type traffic sample, and then the groups are constructed into different sessions according to a time threshold, and the same offset messages in the session belong to the same type of protocol message.

3. The method of claim 1, wherein the network traffic based security protocol semantic level format parsing method is characterized by, Step S2 comprises the following sub-steps: S201. Calculate the entropy value using the formula wherein is the offset position of the byte in the i-th message, is the byte value at the offset position, is the occurrence probability, and the information entropy of the message sequence is calculated byte by byte, entropy[0], entropy[1], entropy[2]... entropyp[i]... entropy[N], wherein N+1 is the number of messages. S202. Compare the entropy of the information p[i] with an entropy threshold of the ciphertext information to determine the plaintext or ciphertext property of the byte. S203. Merge the same attribute bytes of continuous offset, and divide the message into clear text field and cipher text field.

4. The method of claim 1, wherein the network traffic based security protocol semantic level format parsing method is characterized by, Step S4 comprises the following sub-steps: S401. Generate a length field value candidate set according to the domain division result; S402. Slice and calculate the value of 1-4 bytes for the static field and the dynamic field respectively; S403. Cyclically compare the length field value candidate set with the byte slice value, and add the intersection to the possible length field key field set; S404. Cyclically judge whether the possible length field key field set meets the heuristic strategy of the length field key field, and if it meets, it is judged as the length field key field.

5. A network traffic based security protocol semantic level format parsing system, characterized by, It comprises: a data preprocessing module configured to preprocess the original traffic data packet to obtain a single protocol type message sequence; a clear text field and cipher text field division module configured to calculate the information entropy of the message sequence byte by byte, and divide the message into clear text field and cipher text field based on the information entropy; a dynamic field and static field division module configured to replace the cipher text field bytes, encode the clear text field bytes according to the offset, generate two-direction message groups, and mine closed frequent sequences to divide the dynamic field and the static field; a length field key field identification module configured to generate a length field value candidate set according to the domain division result, and perform cyclic comparison with the byte slice value to identify the length field key field; The semantic recognition module of other key fields is configured to recognize semantics of other key fields in the message based on the heuristic strategy and the closed frequent sequence, and output a semantic level format of the security protocol; the heuristic strategy is a strategy formed by combining characteristics of key fields of the security protocol and knowledge of cryptography; The dynamic domain and static domain division module is configured to replace the ciphertext domain with special characters, and perform offset encoding on the plaintext domain bytes; According to the session logic and timing relationship of the message, vertical direction message groups and horizontal direction message groups are generated; the BIDE algorithm is used to mine closed frequent sequences on the vertical direction message groups and the horizontal direction message groups respectively; the plaintext domain is divided into a dynamic domain and a static domain according to the closed frequent sequences of the vertical direction message groups, and a domain division result is output.

6. The network traffic based security protocol semantic level format parsing system of claim 5, wherein, In the data preprocessing module, after obtaining original traffic data packets, grouping filtering and repeated transmission deletion are performed to obtain traffic samples of a single protocol type, and then the groups are constructed into different sessions according to a time threshold, and the same offset messages in the session belong to the same type of protocol message.

7. The network traffic based security protocol semantic level format parsing system of claim 5, wherein, The plaintext domain and ciphertext domain division module is configured to use an entropy value calculation formula , wherein is an offset position of a byte in the i-th message, is a byte value of the offset position, is a probability of occurrence of the byte value, the information entropy entropy[0], entropy[1], entropy[2],..., entropyp[i],..., entropy[N] of the message sequence is calculated byte by byte, wherein N+1 is the number of messages; the information entropy entropyp[i] is compared with an entropy threshold value of the ciphertext information , and the plaintext and ciphertext attributes of the byte are judged. The same attribute bytes of continuous offsets are merged, and the message is divided into a plaintext domain and a ciphertext domain.

8. The network traffic based security protocol semantic level format parsing system of claim 5, wherein, The length domain key field identification module is configured to generate a length domain value candidate set according to the domain division result, slice and calculate values of the static domain and the dynamic domain by 1-4 bytes respectively, cyclically compare the length domain value candidate set with the byte slice values, add the intersection to a possible length domain key field set, cyclically judge whether the possible length domain key field set meets the heuristic strategy of the length domain key field, and determine that it is the length domain key field if it meets the heuristic strategy.

Images