基于半监督子空间聚类的协议识别方法  

Protocol identification approach based on semi-supervised subspace clustering

作　　者：朱玉娜[1] 张玉涛 闫少阁[3] 范钰丹[3] 陈韩托 ZHU Yuna;ZHANG Yutao;YAN Shaoge;FAN Yudan;CHEN Hantuo(Troops 91033 of PLA,Qingdao Shandong 266035,China;Troops 91286 of PLA,Qingdao Shandong 266003,China;PLA Information Engineering University,Zhengzhou Henan 450001,China;Troops 63850 of PLA,Baicheng Jilin 137001,China)

机构地区：[1]中国人民解放军91033部队,山东青岛266035 [2]中国人民解放军91286部队,山东青岛266003 [3]中国人民解放军信息工程大学,郑州450001 [4]中国人民解放军63850部队,吉林白城137001

出　　处：《计算机应用》2021年第10期2900-2904,共5页journal of Computer Applications

摘　　要：针对现有的基于统计特征的协议识别方法选择识别特征时未考虑不同协议个体之间的差异的问题,结合半监督学习和模糊子空间聚类(FSC)方法,提出了一种半监督子空间聚类协议识别方法(SSPIA)。首先,将有标签的样本流转化为成对约束信息,从而获取先验约束条件;其次,在此基础上提出半监督模糊子空间聚类(SFSC)算法,该算法利用约束条件指导子空间聚类过程;然后,建立类簇和协议类型的映射,以获取协议各个特征的权重系数,进而构建个体化的密码协议特征库用于后续协议识别;最后,针对5个典型的密码协议进行聚类效果和识别效果实验。实验结果表明,针对基于统计特征的协议识别问题,与传统K-means方法和FSC方法相比,所提SSPIA的聚类效果更好,且SSPIA构建的协议识别分类器更为精确,协议识别率更高,误识别率更低。所提SSPIA提高了基于统计特征的识别效果。The differences between different protocols are not considered when selecting identification features in the existing statistical feature-based identification methods.In order to solve the problem,a Semi-supervised Subspace-clustering Protocol Identification Approach(SSPIA)was proposed by combining semi-supervised learning and Fuzzy Subspace Clustering(FSC)method.Firstly,the prior constraint condition was obtained by transforming the labeled sample flow into pairwise constraints information.Secondly,the Semi-supervised Fuzzy Subspace Clustering(SFSC)algorithm was proposed on this basis and was used to guide the process of subspace clustering by using the constraint condition.Then,the mapping between class clusters and protocol types was established to obtain the weight coefficient of each protocol feature,and an individualized cryptographic protocol feature library was constructed for subsequent protocol identification.Finally,the clustering effect and identification effect experiments of five typical cryptographic protocols were carried out.Experimental results show that,compared with the traditional K-means method and FSC method,the proposed SSPIA has better clustering effect,and the protocol identification classifier constructed by SSPIA is more accurate,has higher protocol identification rate and lower error identification rate.The proposed SSPIA improves the identification effect based on statistical features.

关 键 词：密码协议 协议识别 统计特征 半监督学习 子空间聚类 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]