【作者】 张丽；

【导师】 张彤；

【作者基本信息】 西安理工大学 ， 计算机应用技术， 2019， 硕士

【摘要】 近年来,随着网络通信规模的不断扩大,小众协议和各种专有通讯协议种类与日俱增,各种网络攻击事件以及僵尸网络层出不穷。肆无忌惮的黑客攻击使得企业和个人用户信息泄露,网络安全问题逐渐得到人们的重视。未知的、私有的网络通信协议是其中一个重要的因素。分析并识别协议数据所采用的消息类型是保障网络安全监管的基础。目前常用协议识别工具采用的方法单一并且针对性强,存在一定的局限性,所以自动化程度和识别准确率较低。针对上述情况,本文以比特流协议数据帧为研究对象,以多协议识别为目标,提出了一种新的协议特征提取与识别方法。本文研究内容主要包括以下三个方面:(1)研究协议特征提取相关的技术与方法,并对现有模式匹配算法、关联规则挖掘算法和聚类算法等应用在协议数据分析领域的优缺点进行比较和分析。在总结现有方法优缺点的基础上,本文提出了新的多模式匹配和关联规则相结合的比特流协议特征提取方法。该方法将关键特征的起始位置也作为特征提取的一个重要因素,通过特征串和起始位置构成协议的复合特征,解决了比特流特征串的冗余问题。同时,将改进的多模式匹配算法与关联规则相结合进行协议复合特征提取,并在其基础上构建了比特流协议特征库,从而为后续研究开展提供了实验和测试平台。(2)本文总结目前协议分析与识别研究中的一些缺陷,提出了改进的协议消息识别和聚类方法。通过与协议特征库中每个协议特征集进行比对确定协议消息的类型。对于不可识别的协议,进行协议特征向量化和数据降维两种预处理操作。接着利用改进的K-means算法,将比特流协议数据帧聚类为多个具有相似协议类型的单协议数据帧。研究过程中,设计并实现的比特流协议特征识别优化算法避免了繁琐的计算,进而简化聚类过程,提高聚类效果。(3)通过本文研究成果设计了比特流协议特征提取与识别的原型系统。系统将比特流协议数据通过预处理后作为系统测试数据。通过在现有评价指标基础上的方法性能分析,证明了多模式匹配与关联规则相结合的方案在提取比特流协议复合特征集上的准确性和系统的有效性,有助于分析其内在规律以及逻辑结构,提高了比特流协议数据解析识别的准确率,对维护网络安全有重要意义。更多还原

【Abstract】 In recent years,with the continuous expansion of network communication scale,the types of minority and proprietary communication protocols are increasing day by day.Various events of network attacks and botnet are emerging in an endless stream.The problem of network security has gradually attracted people’s attention when the enterprises’ and individual’s information is leaked by unscrupulous hacker attacks.One of the most important factors of information leaking is the unknown and private network communication protocols.Analyzing and identifying the message type used in protocol data is the basis of network security supervision.At present,the adopted protocol identification method is single and targeted,which has some limitations.In addition,the degree of automation is relatively low,and the accuracy of protocol identification is not high.In view of the above situation,this paper takes the data frame of bit stream protocol as the research object,and sets multi-protocol recognition as the goal,proposes a new protocol feature extraction and recognition method.This paper mainly includes as the following three parts:First,this paper studies the technologies and methods of protocol feature extraction,analyzes the advantages and disadvantages of existing pattern matching algorithm,association rule mining algorithm and clustering algorithm in the field of protocol data.On the basis of summarizing the advantages and disadvantages of the existing methods,a new feature extraction method of bit stream protocol based on multi-pattern matching and association rules is proposed.The method takes the starting position of key features as an important factor in feature extraction,and solves the redundancy problem of bit stream feature string by combining the feature string and the starting position to form the composite features of the protocol.At the same time,the improved multi-pattern matching algorithm is combined with association rules to extract protocol composite features.What’s more,a feature library of bit stream protocol is constructed based on the improved algorithm,which provides an experimental and testing platform for subsequent research.Second,this paper summarizes some shortcomings in current protocol analysis and recognition research,then proposes an improved protocol message recognition and clustering method.By comparing with each protocol feature set in the protocol feature library the type of protocol message is determined.For unrecognizable bit stream protocols,two preprocessing operations are performed: protocol feature vectorization and data dimensionality reduction.Then,using the improved K-means algorithm,the bit stream protocol data frames are clustered into several single protocol data frames with similar protocol types.In the process of research,this paper designs and implemenst an optimization algorithm for identifying the characteristics of bit stream protocol,which avoids the tedious calculation,simplifies the clustering process and improves the clustering effect.Third,a prototype system for feature extraction and recognition of bit stream protocol is designed based on the research results of this paper.The data of bit stream protocol is pretreated as system test data.Based on the existing evaluation indexes,the method performance analysis proves that the scheme of combining multi-pattern matching and association rules is accurate and effective in extracting the composite feature set of bit stream protocol,which is helpful to analyze its inherent rules and logical structure,and improves the accuracy of the analysis and identification of bit stream protocol data.It is of great significance for maintaining network security.更多还原