A format feature extracting and classifying algorithm for unknown data link frame

doi:10.7523/j.issn.2095-6134.2018.04.015

Abstract

Abstract: With the rapid development of communication network, private protocol is widely adopted. Without necessary prior knowledge, the existing analyzing tools for the open protocols cannot be used for obtaining the information from the private protocol data. To get the information from the private protocol data, one has to extract the protocol format feature and classify the protocol data correctly. Based on the general rules of protocol format, a format feature reverse extracting and data classifying algorithm was proposed for unknown data link frame. By data link frame precoding and fixed-field mining, the frame format features can be extracted from the frame sample set and the feature vectors can be calculated. Finally, the data link frames are classified based on the weighted Euclidean distances between the feature vectors. The test results show that the proposed method can be used to extract the protocol format features effectively and to correctly classify the data link frames by using format features.

Key words: private protocol, unknown data link frame, format feature, classification

CLC Number:

TP393

XUE Kaiping, LIU Bin, LI Wei, HONG Peilin. A format feature extracting and classifying algorithm for unknown data link frame[J]. , 2018, 35(4): 521-528.

References

[1] Narayan J, Shukla K, Clancy T C. A survey of automatic protocol reverse engineering tools[J]. ACM Computing Surveys, 2016, 48(3):1-26.
[2] Beddoe M. The protocol informatics project[EB/OL]. (2004).[2016-09-28]. http://www.4tphi.net/~awalters/PI/PI.html.
[3] Cui W, Paxson V, Weaver N, et al. Protocol-independent adaptive replay of application dialog[C]//Proceedings of the 13th Annual Network and Distributed System Security Symposium. IEEE, 2006:487-490.
[4] Cui W, Kannan J, Wang H J. Discoverer:automatic protocol reverse engineering from network traces[C]//Proceedings of the 16th USENIX Security Symposium. IEEE, 2007:199-212.
[5] Trifilo A, Burschka S, Biersack E. Traffic to protocol reverse engineering[C]//Proceedings of the Second IEEE International Conference on Computational Intelligence for Security and Defense Applications. IEEE, 2009:1-8.
[6] 朱玉娜, 韩继红, 袁霖, 等. SPFPA:一种面向未知安全协议的格式解析方法[J]. 计算机研究与发展, 2015, 52(10):2200-2211.
[7] 潘皤, 洪征, 周振吉, 等. 语义层次的协议格式提取方法[J]. 通信学报, 2013, 34(10):162-173.
[8] 任翔宇, 谈诚, 赵磊, 等. 识别数据结构的协议格式逆向推理方法[J]. 武汉大学学报(工学版), 2015, 48(2):269-273.
[9] 罗建桢, 余顺争, 蔡君.基于最大似然概率的协议关键词长度确定方法[J].通信学报, 2016, 37(6):119-128.
[10] 李伟明, 张爱芳, 刘建财, 等. 网络协议的自动化模糊测试漏洞挖掘方法[J]. 计算机学报,2011, 34(2):242-255.
[11] 孙钦东, 郭晓军, 黄新波. 基于多模式匹配的网络视频流识别与分类算法[J]. 电子与信息学报, 2009, 31(3):759-762.
[12] 王变琴, 余顺争. 未知网络应用流量的自动提取方法[J]. 通信学报, 2014, 35(7):164-171.
[13] 杨哲, 李领治, 纪其进, 等. 基于最短划分距离的网络流量决策树分类方法[J]. 通信学报, 2012, 33(3):90-102.
[14] Wright C, Monrose F, Masson G M. HMM profiles for network traffic classification[C]//Proceedings of the 2004 ACM workshop on Visualization and Data Mining for Computer Security, ACM, 2004:9-15.
[15] Wright C V, Monrose F, Masson G M. Towards better protocol identification using profile HMMs[R]. Technical Report JHU-SPAR051201, Johns Hopkins University, 2005.