基于正则表达式的动态应用层协议识别方案  

Dynamic application layer protocol identification program based on regular expressions

作　　者：王杰[1] 石成辉[1] 

机构地区：[1]郑州大学电气工程学院,郑州450001

出　　处：《计算机工程与应用》2010年第18期103-106,共4页Computer Engineering and Applications

基　　金：河南省杰出人才创新基金(No.074200510013);河南省教育厅自然科学基金(No.2007520048)

摘　　要：传统依赖于端口号的应用层协议识别方法对大量具有随机端口的应用不再适用,设计一种基于正则表达式的动态应用层协议识别方案。在深入分析DFA状态数对算法性能影响的基础上,提出了构造最优DFA状态数的算法,该算法保证在任意有限的系统资源下具有最小的时间复杂度和空间复杂度,并且将报文匹配方式和One-Pass扫描算法相结合进行测试。实验表明此方案具有较低的资源消耗率,较高识别效率和识别精度。Traditional methods of application-layer protocol identification such as using default server port are no longer applica-ble to a large number of random ports application.A dynamic application-layer protocol identification based on regular expression is designed.Through analyzing the impact of number of DFA states to the algorithm performance,a DFA state number optimization algorithm is proposed.This algorithm has the little time complexity and space complexity under the limited system resource.And then packet matching patterns are tested with One-Pass scanning algorithm.Experimental results show that this program has a lower rate of resource consumption,higher efficiency of the identification and recognition accuracy.

关 键 词：协议识别 正则表达式 最优DFA状态数 One-Pass扫描算法 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]