应用层负载特征定义及自动提取方法

A New Format of Packet Signature and Its Automatic Generation Method

针对现有网络流量识别中应用层负载特征提取方法对训练数据中字节值变化较为敏感的问题,首先定义了一种新的以位为最小特征单位的网络流量应用层负载特征,然后设计了相应的自动提取方法。通过3种常用标准协议的实验表明,自动提取方法可以快速获得负载特征,特征识别结果准确性高。对QQ私有应用协议的实验表明,使用获取到的负载特征进行网络流量识别,可以满足实际网络中对QQ网络流量识别的要求。

For the fair sensitivity of the existing application-layer payload signature generation methods to the change of byte value of training data, in network traffic identification, a new format of packet signature with bit as its basic signature unit is defined, and the corresponding automatic generation method thus designed. The experiments with three Internet standard protocols show that this method could effectively generate payload signatures, and these signatures are more accurate. Then the experiment with private protocol QQas an example indicates that the application of generated signature in the actual network could effectively meet the traffic identification requirement of QQ network.