Packet Sequence Clustering Method for Unknown Binary Private Protocol

Abstract

The invention discloses a message sequence clustering method of an unknown binary private protocol, which mainly solves the problem in the prior art that the similarity between protocol message sequences cannot be accurately measured in the protocol reverse process. The implementation scheme is: 1) collecting unknown binary private protocol message sequences; 2) preprocessing the collected message sequences; 3) extracting multi-scale N-gram features of preprocessed message sequences; 4) selecting pairs based on variance Perform dimensionality reduction on multi-scale N-gram features; 5) Embed message sequences according to multi-scale N-gram features after dimension reduction; 6) Determine the optimal number of clusters K according to message sequence embedding representations; 7) Cluster the message sequence according to the optimal clustering number K. The invention fully excavates the latent semantic information of the message sequence, can accurately measure the similarity between the message sequences, improves the accuracy of clustering, and can be used for clustering unknown binary private protocols.

Description

technical field [0001] The invention belongs to the field of information technology, and further provides a message sequence clustering method, which can be used for clustering unknown binary private protocols. Background technique [0002] The network protocol is a specification for entities in the network to communicate, and clearly stipulates the data format and related synchronization issues when communicating entities exchange information with each other. In addition to standardized communication protocols in the network, there are also a large number of unknown private protocols. Packet sequence clustering is the primary task in the protocol reverse process, that is, to separate the packets of each type of private protocol packet sequence according to the similarity between the message sequences to the greatest extent, and then perform field format inference and state machine inference . [0003] Packet sequence clustering of private protocols, that is, the core issu...

AI Technical Summary

Problems solved by technology

In sequence clustering algorithms based on probabilistic models, modeling is often difficult, and it is only very effective in long sequence clustering calculations

Keyword-based sequence clustering algorithm, the more classic one is the Apriori algorithm. The problem with this algorithm is that there will be a large number of overlapping frequent items, which makes the dimension of the feature vector representing the message sequence very large.

Because this method ignores the keyword length of the protocol message sequence, and does not consider the semantic correlation features before and after the words when making the message embedding representation, it cannot accurately measure the similarity between the message sequences, and the clustering effect is poor.

Images