基于内容分析的网络协议指纹识别  

Network Protocol Dactylogram Identification Based on Content Analysis

作　　者：夏琨 丁波 刘俊 刘子豪 林亮成[2] XIA Kun;DING Bo;LIU Jun;LIU Zi-hao;LIN Liang-cheng(State Grid Ningxia Electric Power Company,Ningxia 750001,China;Beijing China Power hfformation Technology- Co.Ltd.,Beijing 100085,China)

机构地区：[1]国网宁夏电力公司,宁夏银川750001 [2]北京中电普华信息技术有限公司,北京100085

出　　处：《计算机与现代化》2018年第5期121-126,共6页Computer and Modernization

摘　　要：针对当前网络协议识别面临的网络带宽持续增加、许多新应用的出现和端口识别局限性的挑战,分析各种识别方法所使用的协议指纹存在的基础、局限性和匹配的难易程度,提出一种基于协议指纹匹配和协议规则验证的协议自识别技术实现协议自识别方法,通过提取不同网络协议类型之间的细微差别,建立网络应用协议指纹特征库,并通过协议验证规则验证协议识别结果的正确性。最后通过实验表明该方法的有效性。In view of the challenge of the increasing network bandwidth of current network protocol recognition,the emerging of the new application and the limit of the port recognition,the basis,limitation and difficulty of matching fingerprints used in various identification methods are analyzed. A protocol self-identification method based on protocol fingerprint matching and protocol rule authentication is proposed to realize the protocol self-identification method. By extracting slight difference between various network protocols,the special network protocol fingerprint database is formed,and the protocol authentication rule is used to verify the correctness of the protocol identification results. The validity of the method is verified by experiments.

关 键 词：网络协议识别 协议指纹识别 正则表达式 协议验证规则 

分 类 号：TP399[自动化与计算机技术—计算机应用技术]