基于隐马尔可夫模型的协议识别技术-信息工程大学学报.pdfVIP

信息工程大学学报 Vo l. 12 No.5 第 12 卷第 5 期 Journal of Information Engineering University Oct. 2011 2011 年 10 月 基于隐马尔可夫模型的协议识别技术 何中阳，杨白薇，李鸥，刘洋 (信息工程大学信息工程学院，河南郑州 450002) 摘要:随着网络的高速发展和协议的复杂化，传统的基于端口号和特征串的应用层协议识别算 法的识别率已明显下降。基于协议统计特征的模式识别方法应运而生，文章提出了一种基于 隐马尔可夫模型的协议识别技术，选取包长、包到达时间间隔、包传输方向等数据包外部特征 组成特征矢量，避免了对数据具体内容的解析;引入了增量学习的思想，实现了对未知协议的 主动学习。实验结果显示，该算法对于控制报文和数据报文均加密的应用层协议同样有很好 的识别效果，识别率达到了 90% 以上。 关键词:隐马尔可夫模型;协议识别;特征提取;增量学习 中图分类号:TN915.04 文献标识码:A 文章编号: 1671 - 0673 (2011) 05 - 0596 - 05 Protocol Identification ßased on Hidden Markov Model HE Zhong-yang , YANG Bai-wei , LI Ou , LIU Yang (Institute of Information Engineering , Information Engineering University , Zhengzhou 450002 , China) Abstract: With the rapid development of networks and increasing complexity of new protocols , tradi- tional port-based and payload-based application-layer protocol identification methods are falling be- hind with poor identification performance. So patlern-matching identification methods based on sta- tistical characteristics have become popular. This paper proposes a protocol identification technique using Hidden Markov Model ( HMM) , whose characteristic oector consists of packet external proper- ties such as packet sizes , inter-arrival times , and packet s franster direction , avoiding in-depth packet payload inspection. Incremental learning is introduced to achieve active learning from un- known application-layer protocols. Experiments show that this method can substantially increase identification accuracy (above 90%