Method and system for network protocol recognition based on tri-classifier cooperative training learning

Abstract

The invention relates to a method and a system for network protocol recognition based on tri-classifier cooperative training learning. The method comprises the following steps: carrying out IP (Internet Protocol) regrouping and TCP (Transmission Control Protocol) traffic reduction on network original traffic, and stipulating the unit of network data from original packets to flow; extracting each message of unidirectional flow feature information and vectoring to build a feature matrix; building a tri-classifier cooperative training classifier with few identified samples; judging whether a classifying model of an analyzed protocol exists or not, and utilizing a tri-classifier cooperative training learning method to build a protocol classifier if the classifying model does not exist, otherwise, judging the protocol attributes of data packets; training by a tri-classifier cooperative training learning algorithm based on J48 and obtaining the classifying model of the analyzed protocol; carrying out protocol type judgment on network data packets not identified, and outputting two classes of results: one class refers to the network data packets belonging to the target protocol, and the other class refers to network data packets not belonging to the target protocol. High recognition accuracy and high recalling rate are ensured by the method.

Description

technical field [0001] The invention relates to a network protocol identification method and system based on the collaborative training and learning of three classifiers, belonging to the network protocol identification technology. Background technique [0002] The network protocol identification technology is a process of associating the network data flow with its corresponding specific network application by analyzing the network data flow. Identifying specific application protocols carried in network data streams is one of the core issues in the field of network security. Network protocol identification technology has a wide range of applications in many fields, such as intrusion detection and prevention system (IDS / IPS), network measurement, application-oriented caching and routing mechanism, application-oriented load balancing, traffic classification and tunnel detection, etc. Therefore, in the network data traffic mixed with multiple protocols, how to identify differe...

AI Technical Summary

Problems solved by technology

However, in the actual analysis process, the acquisition and labeling of network protocol data streams, especially unknown network protocols (such as botnets), relies heavily on domain experts

This is a time-consuming and complicated job

Even when the amount of sample data is too large, manual labeling can no longer meet actual needs

Images