利用统计特征的网络应用协议识别方法  

Network Application Protocol Identification Based on Statistical Methods

作　　者：徐莉[1] 赵曦[2] 赵群飞[1] 秦涛[3] 

机构地区：[1]上海交通大学图像处理与模式识别研究所,上海200240 [2]上海金融学院信息管理系,上海201209 [3]西安交通大学电子与信息工程学院,西安710049

出　　处：《西安交通大学学报》2009年第2期43-47,共5页Journal of Xi'an Jiaotong University

基　　金：国家自然科学基金资助项目(60575049);国家高技术研究发展计划资助项目(2003AA142060)

摘　　要：在网络流统计特征的基础上,提出了一种应用协议识别算法.根据网络流概念,在网络层建立应用协议特征的描述方法,并采用数据量、数据包、时间3种属性全面地描述网络协议的特征.采用主成分分析方法来确定网络流特征属性的主要成分,以减少环境因素的影响.结合BP神经网络算法建立的网络协议识别模型,其网络特征具有良好的持久性和稳定性,模型分类结果也不易受网络环境的影响.真实网络环境下的实验结果显示,所提方法能够准确识别目前网络中常用的应用协议,包括HTTP、FTP、BitTorrent及TELNET,识别准确率达到了97%以上.An application protocol identification method is proposed based on the statistical characteristics of network flows. The flow features at the network level are extracted according to the concept of network flow, and three attributes： the number of packets, the number of bytes, and time, are used to capture the flow characteristics roundly. Then the principal component analysis algorithm is used to determine the main characteristics of the flow attributes to reduce the effect of environment. Finally, a BP neural network model is given to identify the application protocols. As the features used in the proposed method are more stable, the output results of the model are hence accurate with the change of the network environment. Experimental results in real network environments show that the proposed method can identify several major application protocols accurately, such as HTTP, BitTorrent, FTP and TELNET, and the identification precision is above 97 %.

关 键 词：神经网络模型 网络流 应用协议 协议识别 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]