基于序列统计的未知无线协议特征提取方法  

Feature Extraction Method for Unknown Wireless Protocol Based on Sequence Statistical

作　　者：刘治国[1,2] 蔡文珠[1,2] 李运琪 潘成胜 LIU Zhiguo;CAI Wenzhu;LI Yunqi;PAN Chengsheng(School of Information Engineering,Dalian University,Dalian,Liaoning 116600,China;Key Laboratory of Communication and Network,Dalian University,Dalian,Liaoning 116600,China;School of Electronics and Information Engineering,Nanjing University of Information Science and Technology,Nanjing 211800,China)

机构地区：[1]大连大学信息工程学院,辽宁大连116600 [2]大连大学通信与网络重点实验室,辽宁大连116600 [3]南京信息工程大学电子与信息工程学院,南京211800

出　　处：《计算机工程》2021年第11期192-197,共6页Computer Engineering

基　　金：国家自然科学基金(61931004)。

摘　　要：在未知无线网络环境下,比特流形式的协议数据帧特征不明显,且缺乏先验知识对其进行分析,造成特征提取困难。提出一种利用序列统计提取未知无线协议特征的方法。统计数据中定长序列出现的频次和位置,根据概率和相似性筛选满足频繁条件的固定序列和交互序列,得到频繁项集,并借鉴关联规则连接频繁项集中的频繁序列,去除冗余的序列信息,得到协议特征集。仿真结果表明,该方法能够有效提高未知无线协议特征提取效果,准确率稳定在90%以上。In the unknown wireless network environment,the characteristics of data frames in the form of continuous bitstream are not obvious,and the lack of prior knowledge in data frame analysis poses difficulties for feature extraction.To address the problem,a feature extraction method for unknown wireless protocols is proposed based statistical analysis.The frequency and position at which the fixed-length sequences occur in the data are counted.On this basis,the fixed sequences and interactive sequences are filtered according to the probability and the similarity idea,and the ones that meet the frequency conditions are selected to obtain the frequent item set.Then the frequent sequences are connected according to the association rules to remove the redundant information.Simulation results show that this method can improve the feature extraction effect for unknown wireless protocols with the accuracy reaching over 90%.

关 键 词：特征提取 序列统计 固定序列 关联规则 比特流 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]