基于隐马尔可夫模型的协议识别技术  

Protocol Identification Based on Hidden Markov Model

作　　者：何中阳[1] 杨白薇[1] 李鸥[1] 刘洋[1] 

机构地区：[1]信息工程大学信息工程学院,河南郑州450002

出　　处：《信息工程大学学报》2011年第5期596-600,共5页Journal of Information Engineering University

基　　金：国家自然科学基金资助项目(60872043);国家863计划资助项目(2009AA01Z207)

摘　　要：随着网络的高速发展和协议的复杂化,传统的基于端口号和特征串的应用层协议识别算法的识别率已明显下降。基于协议统计特征的模式识别方法应运而生,文章提出了一种基于隐马尔可夫模型的协议识别技术,选取包长、包到达时间间隔、包传输方向等数据包外部特征组成特征矢量,避免了对数据具体内容的解析;引入了增量学习的思想,实现了对未知协议的主动学习。实验结果显示,该算法对于控制报文和数据报文均加密的应用层协议同样有很好的识别效果,识别率达到了90%以上。With the rapid development of networks and increasing complexity of new protocols,traditional portbased and payload-based application-layer protocol identification methods are falling behind with poor identification performance.So patlern-matching identification methods based on statistical characteristics have become popular.This paper p roposes a protocol identification technique using Hidden Markov Model（HMM）,whose characteristic oector consists of packet external properties such as packet sizes,inter-arrival times,and packet ＇s franster direction,avoiding in-depth packet payload inspection.Incremental learning is introduced to achieve active learning fr om unknown application-layer protocols.Experiments show that this method can substantia lly increase identification accuracy（above 90%） of encrypted application-layer prolocols.

关 键 词：隐马尔可夫模型 协议识别 特征提取 增量学习 

分 类 号：TN915.04[电子电信—通信与信息系统]