零知识下的比特流未知协议分类模型

Unknown Bit-stream Protocol Classification Model with Zero-knowledge

针对在零知识下识别比特流未知协议这一问题,提出了一种协议分类模型。该模型首先利用二进制流的固有特性来计算协议种类个数近似值K和初始聚类中心,然后使用改进的K-Means聚类算法指定K及初始聚类中心以进行聚类,最后使用基于信息熵的混杂度评价方法对聚类结果进行评价,可将评价结果较好的类簇作为一种协议类型进行标记,用于其他分析。使用林肯实验室发布的实验数据进行测试,结果表明该模型能以较高的准确率对未知协议进行分类,基于信息熵的类簇评价方法也具有一定实用性。

To solve the difficult problem of unknown bit-stream protocol identification with zero knowledge, a protocol classification model was proposed. Firstly, this model calculates the approximation of parameter K and the initial cluster center using the inherent features of bit-stream, then uses the improved K-Means to cluster data set into different clus- ters by specifying the parameter K and the initial center, and finally evaluates the results of clustering by a hybrid evalu- ation method based on information entropy. The clusters with good evaluation results can be marked and used to study further. Testing data set published by the Lincoln laboratory shows that unknown bit-stream protocols can be classified with high accuracy by this model,and the evaluation method based on information entropy is also useful and effective.