基于改进凝聚层次聚类的协议分类算法  

A protocol classification algorithm based on improved AGNES

作　　者：张凤荔[1] 周洪川[1] 张俊娇[1] 刘渊[2] 张春瑞[2] 

机构地区：[1]电子科技大学信息与软件工程学院,四川成都611731 [2]中国工程物理研究院计算机应用研究所,四川绵阳621900

出　　处：《计算机工程与科学》2017年第4期796-803,共8页Computer Engineering & Science

基　　金：国家NASF基金(U1230106);中国工程物理研究院科学技术发展基金(2012A0403021);四川省科技计划(2014GZ0109;2015KZ002);国家自然科学基金(61472064)

摘　　要：在比特流未知协议识别过程中,针对如何将得到的多协议数据帧分为单协议数据帧这一问题,提出了一种改进的凝聚型层次聚类算法。该算法以传统的凝聚型层次聚类算法思想为基础,结合比特流数据帧的特征,定义了数据帧之间及类簇之间的相似度,采用边聚类边提取符合要求类簇的方式,能快速有效地对数据帧进行聚类;并且该算法能自动地确定聚类的个数,所得的类簇含有相似度评价指标。利用林肯实验室公布的数据集进行测试,说明该算法能以较高的正确率对协议数据帧进行聚类。In the process of bit-stream unknown protocol identification, how to separate multi-protocol data frames into single protocol data frames is a challenging issue. To solve this problem, we propose an improved algorithm based on the idea of traditional AGNES algorithm. Combining the features of bit-stream data frames, this algorithm can define the similarity between data frames and the similarity between clusters by two different ways. We perform clustering and extract clusters that meet the requirements of the class cluster simultaneously. Protocol data frames can be clustered quickly and effectively without inputting the number of clusters. And a similarity evaluation is included in the results of class clusters. Tests on the data set published by the Lincoln Laboratory show that the algorithm has a higher accuracy rate for clustering protocol data frames.

关 键 词：未知协议 协议识别 层次聚类算法 聚类 

分 类 号：TP301[自动化与计算机技术—计算机系统结构]