面向二进制数据帧的聚类系统

Cluster system for binary data frame

为了分离复杂无线网络环境下获取到的二进制数据帧,为后续协议逆向解析提供前提条件,实现了对复杂协议簇协议的聚类系统。首先使用AC算法挖掘出二进制数据帧中的频繁序列特征;然后创新地使用了Apriori算法搜索分析这些特征的关联关系,并且结合二进制流数据帧的特点对结果进行了四步剪枝处理;最后利用筛选出的特征通过改进的K-means算法进行聚类。实验表明,该系统可以对二进制协议数据帧的聚类起到很好的效果,同时对存在TYPE字段的多层协议簇,还能进一步区分出多种协议间的层次关系。

In the complex wireless network environment, in order to separate binary data frames for subsequent reverse protocol analysis,this paper proposed a frame cluster system designed for binary frames using complex protocol stacks. It first used AC algo-rithm to get the frequent set characteristics of the binary frames ,then creatively used the Apriori algorithm to explore the relationship between these characteristics and the 4-step pruning process to choose the most important characteristics, and finally used the selected characteristics and their relationships, in the K-means algorithm to cluster the frames. Experiments show that the result is good,and if the protocol type segments exist,it is possible to distinguish the layered relationships between different clusters.