基于字节熵矢量加权指纹的二进制协议识别

Binary protocol identification based on weighted byte entropy vector

协议识别在入侵检测等网络安全领域具有广泛应用。根据二进制协议特点,提出了一种基于字节熵矢量加权指纹的协议识别方法。对不同协议类型的网络流,利用字节熵矢量描述其报文格式属性,基于局部加权的思想对其进行聚类,得到类簇中心及各类簇字节熵的权重分配,构建协议的字节熵矢量加权指纹,通过指纹的距离度量及距离阈值设定对协议进行识别。实验表明,该方法对常见二进制协议的识别召回率达到94%以上,并可以发现训练集中未出现的协议。

Protocol identification was applied in the field of network security such as intrusion detection. According to the characteristic of binary protocol, this paper proposed a protocol identification method based on weighted byte entropy vector fingerprint. It firstly extracted the byte entropy vector which represented the attribute of the message format from the flow and built the weighted byte entropy vector fingerprint by using locally weighted K-means algorithm. Experiments show that the accuracy of the method for identifying the common binary protocols reach more than 94% , and can find the unknown protocols in the training sets.