基于自编码器的未知协议分类方法  

Method of unknown protocol classification based on autoencoder

作　　者：顾纯祥[1,2] 吴伟森 石雅男 李光松 GU Chunxiang;WU Weisen;SHI Ya’nan;LI Guangsong(School of Cyberspace Security,Information Engineering University,Zhengzhou 450001,China;Henan Key Laboratory of Network Cryptography Technology,Zhengzhou 450001,China)

机构地区：[1]信息工程大学网络空间安全学院,河南郑州450001 [2]网络密码技术河南省重点实验室,河南郑州450001

出　　处：《通信学报》2020年第6期88-97,共10页Journal on Communications

基　　金：国家自然科学基金资助项目(No.61772548);国家自然科学基金创新研究群体资助项目(No.61521003);信息保障技术重点实验室开放基金资助项目(No.KJ-17-001)。

摘　　要：针对互联网中存在的大量未知协议导致网络管理和维护网络安全十分困难的问题,提出了一种未知协议的分类识别方法。结合自编码器技术和改进的K-means聚类技术针对网络流量实现了未知协议的分类识别。利用自编码器对网络流量进行降维和特征提取,使用聚类技术对降维后数据进行无监督的分类,最终实现对网络流量的无监督识别分类。实验结果表明,所提方法分类效果优于传统的K-means、DBSCAN、GMM算法,且具有更高的效率。Aiming at the problem that a large number of unknown protocols exist in the Internet,which makes it very difficult to manage and maintain the network security,a classification and identification method of unknown protocols was proposed.Combined with the autoencoder technology and the improved K-means clustering technology,the unknown protocol was classified and identified for the network traffic.The autoencoder was used to reduce dimensionality and select features of network traffic,clustering technology was used to classify the dimensionality reduction data unsupervised,and finally unsupervised recognition and classification of network traffic were realized.Experimental results show that the classification effect is better than the traditional K-means,DBSCAN,GMM algorithm,and has higher efficiency.

关 键 词：未知协议分类 自编码器 无监督分类 特征提取 

分 类 号：TP181[自动化与计算机技术—控制理论与控制工程]