【作者】 王婷；

【导师】 李胜强；

【作者基本信息】 电子科技大学 ， 密码学， 2019， 硕士

【摘要】 在如今的通信网络技术环境下,无论是通信网络中的安全维护,还是电子对抗中的信号侦察,网络目标识别均具有迫切的现实需求。尤其是针对军事或某些专用网络中使用的非公开网络协议,分析并识别专用网络中的未知协议具有十分重要的研究意义。数据链路层上截获的数据通常以比特流的形式存在,从不具有任何语义的比特流数据中提取出未知协议的特征较为困难。本文研究数据链路层上的未知协议帧结构识别。当前国内外在面向比特流的未知协议识别方面的研究进展缓慢。在现有面向比特流的未知协议识别技术中,通常采用模式匹配和数据挖掘技术进行未知协议的识别。本文尝试基于数据挖掘的思想,从截获的大量未知协议比特流数据中挖掘出具有特殊意义的比特序列,从而进一步推测未知协议的特征与帧结构。首先,本文详细调研了传统面向比特流的未知协议识别方案,主要包括AC(Aho-Corasick)快速统计、频繁序列筛选、长序列拼接和序列关联规则分析等处理流程。通过仿真实验发现,传统方案中存在AC快速统计的存储结构复杂、长序列拼接算法复杂度过高等缺陷。其次,针对传统未知协议识别方案中的上述缺陷,提出了改进的未知协议特征序列挖掘算法。优化了AC快速统计的存储结构,并分析了其与N-gram算法之间的关联性。针对传统长序列拼接复杂度较高的问题,提出了基于位置差的低复杂度长序列拼接算法和基于连续位置的长序列拼接算法。实验结果表明,提出的两种新长序列拼接算法均能够大幅降低拼接的时间复杂度。另外,由于拼接后得到的频繁长序列集合中存在大量具有包含关系的序列,本文提出了一种子序列归并算法。实验结果表明,子序列归并算法对候选特征序列的精简效率达到了81%。最后,利用挖掘到的未知协议候选特征序列集合,本文尝试对未知协议的帧特征进行分析。分别提出了针对定长帧协议的帧长计算算法和针对非定长帧协议的帧切分算法,以及定长帧协议和非定长帧协议的帧结构推测方案。实验结果表明,提出的新方案能够有效确定未知协议的特征和帧结构。更多还原

【Abstract】 With the current communication and network technology environment,network target recognition has urgent practical needs,for the security maintenance of communication networks and signal reconnaissance in electronic countermeasures.Especially for non-public network protocols used in military or some private networks,analyzing and identifying unknown protocols in private networks is of great research significance.The data intercepted on the data link layer usually exists in the form of a bit stream,and it is difficult to extract the characteristics of the unknown protocol from the bit stream data without any semantics.This thesis studies the unknown protocol frame structure identification on the data link layer.At present,research on the identification of unknown protocols for bit streams at home and abroad is progressing slowly.In the existing bit-stream-oriented unknown protocol identification technology,pattern matching and data mining techniques are usually used to identify unknown protocols.Based on the idea of data mining,this thesis attempts to mine the bit sequence with special significance from the intercepted large number of unknown protocol bit-stream data,so as to further speculate the characteristics and frame structure of the unknown protocol.Firstly,this thesis investigates the traditional bit stream-based unknown protocol identification scheme,including AC(Aho-Corasick)fast counting,frequent sequence filtering,long sequence splicing and sequence association rule analyzing.Through simulation experiments,it is found that the storage structure of AC fast counting algorithm is complex and the complexity of long sequence stitching algorithm is also too large in the traditional scheme.Secondly,aiming at the above defects in the traditional unknown protocol identification scheme,an improved unknown-feature sequence mining algorithm is proposed.The storage structure of AC fast counting is optimized,and its correlation with N-gram algorithm is analyzed.Aiming at the problem of high complexity of traditional long-sequence splicing,a low-complexity long-sequence splicing algorithm based on position difference and a long-sequence splicing algorithm based on continuous position are proposed.The experimental results show that the proposed two new long sequence splicing algorithms can effectively reduce the time complexity.In addition,due to the existence of a large number of sequences with inclusive relationships in the frequent long sequence sets obtained after splicing,a seed sequence merging algorithm is proposed in this thesis.The experimental results show that the sub-sequence merging algorithm achieves a reduction efficiency of 81% for candidate feature sequences.Finally,using the mined candidate feature sequence set of unknown protocol,this thesis attempts to analyze the frame characteristics of the unknown protocol.The frame length calculation algorithm for fixed-length frame protocol and the frame segmentation algorithm for non-fixed-length frame protocol,and the frame structure estimation scheme for fixed-length frame protocol and non-fixed-length frame protocol are proposed respectively.The experimental results show that the proposed new scheme can effectively determine the characteristics and frame structure of the unknown protocol.更多还原