立体化网络应用层协议识别的研究与实现  

Research and implementation of three-dimensional network application layer protocol identification

作　　者：朱宇[1] 袁帅[1] 

机构地区：[1]西安科技大学计算机科学与技术学院,陕西西安710054

出　　处：《电子技术应用》2014年第1期60-63,共4页Application of Electronic Technique

摘　　要：针对由于动态端口和加密通信协议的不断使用、应用层协议识别难度增加以及对高速网络的快速识别需求提升的问题,提出了一种立体化的应用层协议识别方法。其依据树形分类思想,根据数据包的多元信息进行分层过滤识别。通过加入表驱动方法,协议特征库使用动态模块化加载方式和改进基于统计的识别算法,采用SVM的分类模型,实现了准确、快速和易于扩展的应用层协议识别。通过真实网络环境下的测试结果得出,此系统能够保证较小的延时和95%以上的识别率。Aimming at the problem that dynamic port and the encryption communication protocol are frequently used,identifica- tion difficulty is increasing and and quickly identification requirements for high-speed network is also rising. The paper puts forward with a three-dimensional application layer protocol identification method. The method mainly is based on tree classification thought and uses the multi-information packets for hierachical filter identifying, which joined with table-dliven technique, characteristic library, used the dynamic module loading, and improved recognition algorithm based on statistical,combined with SVM classification model. It realized the three-dimensional application layer protocol for the accurate,fast and extensible identification. Finally, the results show that the system able to ensure low latency and more than 95% identification rate according to the testing in the real network environment.

关 键 词：协议识别 支持向量机 应用协议 网络 特征匹配 

分 类 号：TP393.07[自动化与计算机技术—计算机应用技术]