多尺度被动式网络业务发现与识别  

Multi-scale Passive Network Service Discovery and Identification

作　　者：徐耀令 陈玉成 陈勇群 XU Yao-ling;CHEN Yu-cheng;CHEN Yong-qun(No.36 Research Institute of CETC,Jiaxing Zhejiang 314033,China;Science and Technology on Communication Information Security Control Laboratory,Jiaxing Zhejiang 314033,China)

机构地区：[1]中国电子科技集团公司第三十六研究所,浙江嘉兴314033 [2]通信信息控制和安全技术重点实验室,浙江嘉兴314033

出　　处：《通信对抗》2023年第4期28-31,58,共5页Communication Countermeasures

摘　　要：从网络空间实战要求出发,以战场态势多尺度表达的概念、战场实体的聚合解聚模型、目标的显示控制方法作为需求基础,依据流量探测信息在空间、时间和语义维度上的广度和粒度,提出了网络流量态势尺度聚合方法的类别、特点及适用性,并给出空间维和语义维上网络多尺度表达方法。对被动式网络业务发现与识别通用体系框架进行了定义,提出基于数据包结构、深度包数据内容、动态流行为及SDN资源调度、物联网/智能网络设备流量等分析技术,能够为基于流量特征的网络业务行为分析工作提供业务指导和规范。Starting from the actual requirements of cyberspace,taking the concept of multi-scale expression of battlefield situation,the aggregation and disaggregation model of battlefield entities,and the display control method of targets as the basis of requirements,based on the breadth and granularity of traffic detection information in space,time and semantic dimensions.The categories,characteristics and applicability of the network traffic situation scale aggregation method are proposed,and the network multi-scale expression method in the spatial dimension,time dimension and semantic dimension is given.A general system framework for passive network service discovery and identification is defined,and analysis technologies such as packet structure,deep packet data content,dynamic trafic behavior,SDN resource scheduling,and IoT/intelligent network device traffic can provide business guidance and standardization for network business behavior analysis based on traffic characteristic.

关 键 词：网络业务 多尺度表达 被动式输入 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]