基于关联规则挖掘的未知协议特征提取方法  

Identification Method of Unknown Protocol Signatures Based on Association Rules Mining

作　　者：蔡乐[1,2] 石荣 许都[1] 

机构地区：[1]电子科技大学,成都611731 [2]电子信息控制重点实验室,成都610036

出　　处：《电子信息对抗技术》2016年第6期18-23,57,共7页Electronic Information Warfare Technology

摘　　要：在日益激烈的通信对抗中,未知协议的分析与识别占据着越来越重要的位置。传统的协议分析主要是针对已知协议类型条件下,对互联网数据传输过程中产生的大量比特流,单纯采用模式匹配方式进行特征序列提取,效率较低。针对这一问题,以更普遍的通信数据流作为研究对象,采用模式匹配和数据挖掘相结合的方法,对AC多模式识别和FP-Growth算法进行了改进和优化,提高了特征序列提取的准确率和效率。实际数据验证证明改进后算法对未知通信协议具有一定的识别效率。In the field of communication countermeasure, the analysis and identification of un- known protocol become more and more important. In terms of known protocol types, the tradi- tional protocol identification is mainly to analyze a large number of the bit stream in the internet, it is inefficient to extract signatures with pattern matching. To solve this problem, a method of combining pattern matching and data mining to analyze more general communication data is propsed at the same time, AC multi-pattern recognition and FP-Growth algorithm are optimized to improve the accuracy and efficiency of signatures extracting. The effectiveness of the improved algorithm is verified by actual data, which has a certain reference value for improving the effi- ciency of the unknown communication protocol identification.

关 键 词：关联规则 数据挖掘 AC多模式识别 FP—Growth 未知协议 特征提取 

分 类 号：TN975[电子电信—信号与信息处理]