基于最大似然概率的协议关键词长度确定方法-信息通信学术期刊网.PDFVIP

第37 卷第6 期 通 信 学 报 Vol.37 No.6 2016 年6 月 Journal on Communications June 2016 doi:10.11959/j.issn.1000-436x.2016121 基于最大似然概率的协议关键词长度确定方法 1 2 1 罗建桢 ，余顺争 ，蔡君 (1. 广东技术师范学院电子与信息学院，广东 广州 510665；2. 中山大学电子与信息工程系，广东 广州 510006 ) — 摘 要：提出非齐次左 右型级联隐马尔可夫模型，用于应用层网络协议报文建模，描述状态之间的转移规律和 各状态的内部相位变化规律，刻画报文的字段跳转规律和字段内的马尔可夫性质，基于最大似然概率准则确定协 议关键词的长度，推断协议关键词，自动重构协议的报文格式。实验结果表明，所提出方法能有效地识别出协议 关键词和重构协议报文格式。 关键词：隐马尔可夫模型；协议逆向工程；网络安全；报文格式 中图分类号：TP393 文献标识码：A Method for determining the lengths of protocol keywords based on maximum likelihood probability 1 2 1 LUO Jian-zhen , YU Shun-zheng , CAI Jun (1. School of Electronic and Information, Guangdong Polytechnic Normal University, Guangzhou 510665, China; 2. School of Information Science and Technology, Sun Yat-Sen University, Guangzhou 510006, China) Abstract: A left-to-right inhomogeneous cascaded hidden Markov modelwas proposed and applied to model application protocol messages. The proposed modeldescribed the transition probabilities between states and the evolution rule of phases inside the states,revealed the transition feature ofmessage fields and the left-to-right Markov characteristicsinside the fields. The protocol keywords were inferred by selecting lengths with maximum likelihood probability, and then the message format was recovered. The experimental results demonstrated that the proposed method perform well in proto