Method for digging recognition characteristic of application layer protocol

Abstract

The invention discloses a method for digging identification characteristics of application layer protocol. The method comprises the following steps of: A, filtering firstly and coding a training data packet set, extracting standard protocol identification characteristic data information; B, performing a first digging to the extracted standard protocol identification characteristic data information to obtain a multistage frequent set; C, performing the first digging to the multistage frequent set, and correcting frequent degree of the rest multistage frequent set after the first digging, performing a second digging to obtain final protocol identification characteristics; D, if byte identification rate of all the final protocol identification characteristics meets the demand, or the total identification rate of the data packet meets the demand, no longer digging the data of the second and the subsequent data packets; otherwise, circularly digging the second and the subsequent data packets until the total identification rate meets the demand. The invention can analyze, dig the data packet set, and extract all the identification characteristics of the corresponding application layer protocol, which greatly improves characteristic extraction efficiency and the total identification rate.

Description

technical field [0001] The invention relates to the technical field of computer network flow monitoring and analysis, in particular to a mining method for application layer protocol identification features. Background technique [0002] Network application layer traffic identification is crucial to network planning, network management, traffic engineering, security detection, etc. The traditional application layer identification method is mainly based on the Internet Assigned Numbers Authority (IANA) to define the protocol port corresponding to the application, but for the purpose of hiding traffic or other aspects, the existing technology uses a large number of dynamic protocol ports or encrypted data Packet load, which brings great challenges to traditional application layer identification methods. [0003] In order to solve this problem, a deep packet inspection (Deep Packet Inspection, DPI) identification method has been proposed. The method finds out the characteristi...

AI Technical Summary

Problems solved by technology

[0009]However, relying on manual analysis to realize the mining method of application layer protocol identification features, the feature extraction efficiency is very low, which cannot meet the continuous emergence of new application layer protocols and the frequent occurrence of existing protocols. The need for upgrading, moreover, the recognition features found through manual observation are usually incomplete, resulting in low overall recognition efficiency

Images