一种二进制私有协议字段格式划分方法  

Approach of Field Format Extraction in Binary Private Protocol

作　　者：秦中元 陆凯 张群芳 黄星期 QIN Zhong-yuan;LU Kai;ZHANG Qun-fang;HUANG Xing-qi(School of Cyber Science and Engineering,Southeast University,Nanjing 210096,China;Artillery and Air defence Institute,Nanjing Campus,Nanjing 211132,China)

机构地区：[1]东南大学网络空间安全学院,南京210096 [2]炮兵防空兵学院南京校区,南京211132

出　　处：《小型微型计算机系统》2019年第11期2318-2323,共6页Journal of Chinese Computer Systems

基　　金：江苏省自然科学基金项目(bk20161099)资助

摘　　要：针对现有基于频繁项挖掘的协议字段格式划分方法以字节作为划分的基本单位,不能完全适用于二进制私有协议数据,以及在挖掘得到频繁项集合后缺乏有效的格式划分定界方法的问题,该文提出了一种改进的基于频繁项挖掘的协议字段格式划分方法.通过构建半字节为最小长度的、长度逐渐增加的最大项集,并采用常见度和位置熵指标进行频繁项筛选,最后基于正向最大匹配进行投票以及对投票结果进行筛选来完成格式划分.仿真实验结果表明,该文方案能够得到比传统的AutoRe Engine方案更高的精确度.Aiming at the problem that the way of constructing frequent items by bytes in the existing schemes cannot be completely applied to the problem of the binary private protocol and these schemes lack effective steps of format extraction,this paper proposes an improved method of protocol format extraction based on frequent item mining. Firstly,construct the maximum item sets which the shortest length of item is nibble,then use the supportiveness and the location entropy to filter frequent items. After that,the voting based on positive maximum matching is used to complete the format extraction. Experiments show that our method can obtain more accurate results than traditional AutoRe Engine scheme.

关 键 词：网络流量 协议逆向 频繁项挖掘 格式划分 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]