基于频繁统计和关联规则的未知链路协议比特流切割算法

An unknown link protocol bit stream segmentation algorithm based on frequent statistics and association rules

现代电子对抗中,监听者在链路层获得的一般是未知比特数据流,在未知帧格式的情况下,正确地从中切割出完整帧是一个难点,为此提出一种基于数据挖掘的比特流切割算法.首先分析了协议帧的结构以及数据流中各帧之间的关联特性,然后通过频繁统计和关联规则验证,识别并提取出标志着帧起始的特征序列及关联规则序列,针对设定的结果数量门限N,能够给出N种最具可能性的切割方案.实际数据测试验证了该算法的有效性和鲁棒性.

In the field of modern electronic countermeasure, eavesdroppers want to capture information from the data link layer （DLL）, which is, however, always displayed in an unknown bit stream format. It is a challenge to extract each frame from the bit stream without knowing the frame structure. To solve this problem, a bit stream segmentation algorithm based on data mining was proposed. First, the structure of protocol frames and the correlation between the frames in the data stream was analyzed. Then, using frequency statistics and verifying with association rules, the characteristic sequences which marked the start and the end of a frame was recognized and extracted, as well as the association rule sequences from the data stream. Finally, the bit stream was segmented on the basis of these sequences. According to a threshold N on the amount of results, the algorithm could provide N kinds of most feasible segmentation solutions. Experimental results show that the proposed algorithm is effective and robust.