基于关联规则挖掘的未知协议特征提取方法

Identification Method of Unknown Protocol Signatures Based on Association Rules Mining

在日益激烈的通信对抗中,未知协议的分析与识别占据着越来越重要的位置。传统的协议分析主要是针对已知协议类型条件下,对互联网数据传输过程中产生的大量比特流,单纯采用模式匹配方式进行特征序列提取,效率较低。针对这一问题,以更普遍的通信数据流作为研究对象,采用模式匹配和数据挖掘相结合的方法,对AC多模式识别和FP-Growth算法进行了改进和优化,提高了特征序列提取的准确率和效率。实际数据验证证明改进后算法对未知通信协议具有一定的识别效率。

In the field of communication countermeasure, the analysis and identification of un- known protocol become more and more important. In terms of known protocol types, the tradi- tional protocol identification is mainly to analyze a large number of the bit stream in the internet, it is inefficient to extract signatures with pattern matching. To solve this problem, a method of combining pattern matching and data mining to analyze more general communication data is propsed at the same time, AC multi-pattern recognition and FP-Growth algorithm are optimized to improve the accuracy and efficiency of signatures extracting. The effectiveness of the improved algorithm is verified by actual data, which has a certain reference value for improving the effi- ciency of the unknown communication protocol identification.