改进的双重特征协议识别方法研究  

Research on Improved Protocol Identification based on Twofold Characteristics

作　　者：王欣[1] 徐智[1] 黄其新[1] 

机构地区：[1]三江学院电气与自动化工程学院,江苏南京210012

出　　处：《信息安全与技术》2014年第8期33-35,共3页

摘　　要：传统识别方法难以满足现实网络环境的实际需要。文章利用协议的端口和特征串双重特征进行识别,并且根据实际的网络统计所需要识别协议的真实流量,正确化简正则表达式来实现对协议识别的加速。结果证明,与L7-filter正则表达式识别方法比较,采用方法能有效降低资源消耗和匹配时间,提高识别率。Traditional identification method is dif icult to meet the actual needs of the real network environment. This paper uses the port and the characteristics of the protocol for identification. Also it statistics the real flow according to the actual network need to be identified and simplified the regular expression to accelerate the identification. Results show that compared with L7-filter, the method can reduce resource consumption and matching time ef ectively and improve the recognition rate.

关 键 词：协议识别 正则表达式 特征串 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]