基于粗糙集聚类的报文格式推断方法  

Message Format Inference Method Based on Rough Set Clustering

作　　者：李毅豪 洪征 林培鸿 冯文博 LI Yi-hao;HONG Zheng;LIN Pei-hong;FENG Wen-bo(Army Engineering University of PLA,Nanjing 210000,China)

机构地区：[1]中国人民解放军陆军工程大学,南京210000

出　　处：《计算机科学》2020年第12期319-326,共8页Computer Science

基　　金：国家重点研发计划基金资助项目(2017YFB0802900)。

摘　　要：报文聚类是报文格式推断的基础,现有的报文聚类方法大多以报文的全局相似性为聚类的标准,这类聚类方法的准确率往往不高,进而影响后续报文格式提取的准确率。针对这一问题,文中提出了一种基于粗糙集聚类的报文格式推断方法,该方法包括预处理、基于粗糙集的聚类、特征词提取和报文格式推断4个阶段。首先,通过数据预处理分离出目标报文中的业务类报文和控制类报文;其次,按照粗糙集理论中基于属性划分样本的方法对报文的统计特征进行聚类,这种聚类方法能够准确获取报文序列的局部特征,能够达到较好的聚类效果;然后,根据长度、频率和位置特征来提取协议特征词;最后,将协议特征词分为必选字段和可选字段,并用它们来描述报文格式。实验结果表明,该方法能够准确地获取协议的报文格式。Message clustering is an important procedure of message format inference.Most of the existing message clustering methods take message global similarity as the clustering criteria.However,the accuracy of such clustering methods is often not high enough,and affects the accuracy of subsequent message format extraction.To solve this problem,this paper proposes a message format inference method based on rough set clustering,which consists of preprocessing phase,rough-setbased clustering phase,feature word extraction phase and message format extraction phase.Firstly,messages are separated into business messages and control messages.Secondly,messages are clustered on the basis of position attributions according to rough set theory,and the clustering method considers local features of message sequences which ensures high accuracy of message clustering.Thirdly,protocol feature words are extracted according to length,frequency and position characteristics.Finally,protocol feature words are classified into mandatory fields and optional fields,and they are used to represent message formats.Experimental results show that the proposed method can extract message formats precisely.

关 键 词：协议逆向工程 报文聚类 报文格式推断 粗糙集理论 特征词提取 

分 类 号：TP398.08[自动化与计算机技术—计算机应用技术]