基于深度学习的二进制变种协议字段划分方法  

Binary variant protocol field format extraction method based on deep learning

作　　者：安晓明 王忠勇[2] 翟慧鹏 巩克现 王玮[2] 孙鹏[2] AN Xiao-ming;WANG Zhong-yong;ZHAI Hui-peng;GONG Ke-xian;WANG Wei;SUN Peng(Henan Institute of Advanced Technology,Zhengzhou University,Zhengzhou 450000,China;School of Electrical and Information Engineering,Zhengzhou University,Zhengzhou 450001,China;Department of Technology Guarantee,National Computer Network and Information Security Management Center Henan Branch,Zhengzhou 450000,China)

机构地区：[1]郑州大学河南先进技术研究院,河南郑州450000 [2]郑州大学电气与信息工程学院,河南郑州450001 [3]国家计算机网络与信息安全管理中心河南分中心技术保障处,河南郑州450000

出　　处：《计算机工程与设计》2024年第4期982-988,共7页Computer Engineering and Design

基　　金：国家自然科学基金青年基金项目(61901417);河南省科技攻关基金项目(212102210173、212102210566);国家重点研发计划“前沿科技创新”专项基金项目(2019QY0302)。

摘　　要：为提高二进制变种协议字段格式划分的准确率,提出一种基于深度学习的方法,能够自动挖掘协议报文序列的深层字段特征完成协议的字段格式划分。引入一种字段列特征数据集的提取方法,在传统的双向长短期记忆条件随机场网络模型的基础上增加协议字段列特征提取模块,搭建一种专门解决二进制变种协议字段格式划分的神经网络PRO-BILSTM-CRF。与二进制未知协议字段格式划分方法以及几种主流网络模型的对比实验结果表明,在变种协议字段格式划分任务上,提出模型能够取得更高准确率。To improve the accuracy of field format extraction of binary variant protocol,a deep learning-based method was proposed,which automatically mined the deep field characteristics of the protocol message sequence to complete the field format division of the protocol.A method of extracting field column feature dataset was introduced,and a protocol column feature extraction module was added on the basis of traditional BILSTM-CRF neural network.A new neural network,Pro-BILSTM-CRF,was constructed to solve the field format extraction of binary variant protocol.Compared with the binary unknown protocol field format partitioning method and several mainstream network models,the experimental results show that the proposed model can achieve higher accuracy in the field format partitioning task of variant protocol.

关 键 词：二进制变种协议 深度学习 双向长短期记忆模型 条件随机场 特征提取 字段格式划分 协议逆向工程 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]