Packet Analysis Apparatus Using Cross-Correlation for Unknown Format Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies fail to effectively analyze packets of unknown formats, as they cannot determine the format if no similar features are found during comparison with known formats.
Innovation Solution
A packet analysis apparatus and method that calculates cross-correlation values among packets, groups them based on these values, and identifies field boundaries by selecting bit positions with lower variation degrees, allowing for the determination of packet fields and properties.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If packet formats are compared with known formats to identify unknown packets, then analysis efficiency is improved, but analysis capability deteriorates when no similar features are found
Solution Approach 1:
The system performs self-learning by automatically analyzing packet structures and building format profiles without requiring pre-existing known formats. The processor examines packet sequences, identifies recurring patterns, and autonomously constructs format definitions including field boundaries, data types, and structural relationships, enabling the system to handle previously unseen packet formats
Solution Approach 2:
The system transforms the analysis approach by changing from format-matching parameters to statistical pattern recognition parameters. It analyzes packet sequences using frequency analysis, correlation coefficients, and entropy calculations to identify structural patterns, allowing it to adapt to diverse packet formats without relying on predefined format specifications
2Measurement precision
If packet sequences are analyzed to identify patterns, then format determination accuracy is improved, but processing time increases
Solution Approach 1:
The system performs preliminary analysis by examining packet sequences and pre-identifying potential format patterns before formal format definition. It conducts initial pattern recognition, pre-calculates correlation metrics, and prepares candidate format structures in advance, reducing the time required for final format determination while maintaining high accuracy
Solution Approach 2:
The analysis process is divided into multiple stages: packet sequence segmentation, pattern identification within segments, correlation analysis between segments, and final format synthesis. This segmented approach allows parallel processing of different packet portions and enables progressive refinement of format hypotheses, improving both accuracy and efficiency
Data Source
AI summary
A packet analysis apparatus, method, and non-transitory computer readable medium thereof are provided. The packet analysis apparatus stores a plurality of packets whose formats are unknown. The packet analysis apparatus calculates a plurality of cross-correlation values of the packets. The packet analysis apparatus decides at least one group according to the cross-correlation values and at least one first threshold, wherein each group includes a subset of the packets. The packets included in a specific group of the groups define a plurality of bit positions. Each packet included in the specific group has a plurality of bits. For each of the bit positions, the packet analysis apparatus calculates a variation degree of the bits corresponding to the bit positions. The packet analysis apparatus selects the at least one bit position whose variation degree(s) is/are smaller than a second threshold as at least one field boundary of the specific group.