基于数据报指纹关系的未知协议识别与发现  

Network traffic identification based on data finger-print

作　　者：宋疆[1] 张春瑞[2] 张楠[1] 李芬[2] 吴艳梅[1] 

机构地区：[1]电子科技大学计算机科学与工程学院,成都611731 [2]中国工程物理研究院计算机应用研究所,四川绵阳621900

出　　处：《计算机应用研究》2012年第12期4604-4606,4614,共4页Application Research of Computers

基　　金：国家"242"信息安全计划资助项目(2010A14);国家科技重大专项资助项目(2011ZX03002-002-03);四川省科技支撑计划资助项目(2010FZ0101);中国工程物理研究院科学发展技术基金资助项目(2012A0403021)

摘　　要：目前,关于窃密防范措施基本上只针对已知协议,为了保证网络的安全运行以及对攻击与危害行为的预警,迫切需要在当前结构复杂的网络环境下为决策者准确提供一种能高效地对未知协议进行识别的方法。为此,在整合已有的网络安全和数据挖掘技术的基础上,设计了基于数据报指纹关系的未知协议识别发现的解决方案。As all of the current communication protocols are unconventional dedicated unknown ones while existing of prevention measures mainly aiming at the known protocols and based on port mapping or static features matching,they are useless for the monitoring and detection of the theft channel.To ensure the security of the network as well as the early warning of attacks and harmful behavior,policy-makers urgently need to provide an efficient way to identify an unknown protocol under the current structure of the complex network environment.To solve these problems,this project would integrate the existing network security and data mining technology to design solutions discovering unknown protocols based on the datagram fingerprint relations,to meet the national cyber security and many other needs.In addition to a significant meaning on the protection of network security and macro warning area,it promoted and improved the capability of independent innovation of China＇s network security and other aspects of the key technologies at the same time.

关 键 词：无线数据获取 机器学习 频繁集 指纹特征 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]