自适应网络应用特征发现方法

doi:10.3969/j.issn.1000-436x.2013.04.015

通信学报 ›› 2013, Vol. 34 ›› Issue (4): 127-137.doi: 10.3969/j.issn.1000-436x.2013.04.015

自适应网络应用特征发现方法

王变琴^1,²,余顺争¹

¹ 中山大学信息科学与技术学院，广东广州 510006
² 中山大学教学实验中心，广东广州 510006

出版日期:2013-04-25 发布日期:2017-07-17
基金资助:
国家高技术研究发展计划（“863”计划）基金资助项目;国家自然科学基金—广东联合基金重点项目资助;国家自然科学基金资助项目

Adaptive extraction method of network application signatures

Bian-qin WANG^1,²,Shun-zheng YU¹

¹ School of Information Science and Technology,Sun Yat-sen University,Guangzhou 510006,China
² Education ＆ Experiment Center,Sun Yat-sen University,Guangzhou 510006,China

Online:2013-04-25 Published:2017-07-17
Supported by:
The National High Technology Research and Development Program of China(863 Program);The Key Program of National Natural Science Foundation of China Guangdong Joint Funds;The National Natural—Science Foundation of China

摘要/Abstract

摘要：

提出了一种应用特征的自动提取方法。该方法首先从应用层载荷中提取关键词序列，然后通过负例子集合和冗余处理生成候选特征集，最后通过基于识别率的自适应机制选择应用特征。实验结果表明，该方法提取的应用特征能精确识别不同的协议。

关键词: 应用特征, 关键词挖掘, 自适应特征提取, 应用识别

Abstract:

An adaptive application signature extraction method (AdapSig) was proposed.AdapSig firstly extracted keyword sequences from payloads of packets,and then negative examples and redundancy filter were used to generate candidate signatures.An adaptive mechanism based on self-identification rate was applied to select the final si ture.Experimental results show that application signatures extracted by AdapSig have high accuracy for various protocols.

Key words: application signature, keyword minging, adaptive signature extraction, application identification

王变琴,余顺争. 自适应网络应用特征发现方法[J]. 通信学报, 2013, 34(4): 127-137.

Bian-qin WANG,Shun-zheng YU. Adaptive extraction method of network application signatures[J]. Journal on Communications, 2013, 34(4): 127-137.

图/表 12

图1

图2

图3

表1

表2

图4

图5

图6

图7

图8

图9

图10

参考文献 16

[1]	Internet assigned numbers authority(IANA)[EB/OL]. , 2012.
[2]	BERNAILLE L , TEIXEIRA R , AKODKENKUT I , et al. Traffic classification on the fly[J]. ACM SIGCOMM Computer Communication Review, 2006,36(2): 23-26.
[3]	CROTTI M , DUSI M , GRINFOLI F , et al. Traffic classification through simple statistical fingerprinting[J]. ACM SIGCOMM Computer Communication Review, 2007,37(1): 1-16.
[4]	SEN S , SPATSCHECK O , WANG DM . Accurate,scalable in-network identification of P2P traffic using application signat[A]. Proceedings of WWW2004[C]. New York,USA, 2004. 512-521.
[5]	Application layer packet classifier for linux[EB/OL]. , 2012.
[6]	HAFFNER P , SEN S , SPATSCHECK O , et al. ACAS:automated construction of application signatures[A]. Proceedings of ACM SIGCOMM MineNet Workshop[C]. Philadelphia,USA, 2005. 197-202.
[7]	MA J , LEVCHENKO K , KREIBICH C , et al. Unexpected means of protocol inference[A]. Proceedings of the 6th ACM SIGCOMM conference on Internet measurement[C]. Rio de Janeriro,Brazil, 2006. 313-326.
[8]	PARK B C , WON Y J , KIM M S , et al. Towards automated application signature generation for traffic identification[A]. Proceedings of the IEEE/IFIP Network Operations and Management Symposium[C]. Salvador,Bahia,Brazil, 2008. 160-167.
[9]	WANG Y , XIANG Y , ZHOU W L , et al. Generating regular expression signatures for network traffic classification in trusted network management[J]. Journal of Network and Computer Applications, 2011,17: 1-9.
[10]	赵咏, 姚秋林, 张志斌等． TPCAD：一种文本类多协议特征自动发现方法[J]．通信学报, 2009,30(10A):28-35. ZHAO Y , YAO Q L , ZHANG Z B , et al. TPCAD:a text-oriented multi-protocol inference approach[J]. Journal on Communications, 2009,30(10A):28-35.
[11]	刘兴彬, 杨建华, 谢高岗等. 基于Apriori算法的流量识别特征自动提取方法[J]．通信学报, 2008,29(12):51-59. LIU X B , YANG J H , XIE G G , et al. Automated mining of packet signatures for traffic identification at application layer with Apriori algorithm[J]. Journal on Communications, 2008,29(12):51-59.
[12]	AGRAWAL R , SRIKANT R . Fast algorithms for mining assoc ion rules[A]. Proceedings of the 20th International Conference on Very Large Data Bases[C]. San Francisco,CA,USA, 1994. 487-499.
[13]	龙文, 马坤, 辛阳等. 适用于协议特征提取的关联规则改进算法[J]. 电子科技大学学报， 2010,39(2):302-305. LONG W , MA K , XIN Y , et al. Improved association rules algorithm for protocol signatures extracting[J]. Journal of University of Electronic Science and Technology of China, 2010,39(2):302-305.
[14]	YE M J , XU K , WU J P , et al. AutoSig-automatically generating signatures for applications[A]. IEEE Ninth International Conference on Computer and Information Technology[C]. Xiamen,China, 2009. 104-109.
[15]	HAN J , PEI J , YIN Y . Mining frequent patterns without ndidate generatio[A]. Proceedings of the 2000 ACM SIGMOD[C]. Dalas,TX,USA, 2000. 1-11.
[16]	AGRAWAL R , SRIKANT R . Mining sequential patterns[A]. Proceedings of the Eleventh International Conference on Data Engineering[C]. 1995. 3-14.

协议	会话数量	分组数量	容量/Mbyte
HTTP	880	57 568	77.2
FTP	920	20 616	102.24
SMTP	652	32 884	60.32
POP3	512	600 072	72.8
MSN	556	52 460	18.52
BT	1 184	297 594	44.7

协议	本文的AdapSig 获得的精简特征	AutoSig 获得的特征	L7-filter 的特征 (RegExp)
HTTP	“GET\x20/”\|“HTTP/1.”	“HTTP/1.”\|“GET\x20/,HTTP/1.”	“http/(0\.9\|1\.0\|1\.1)[1-5][0-9][0-9][\x09-\x0d -~]…\|post[\x09-\x0d -~]…”truncated
BT	“\x13BitTorrent\x20protocol”	“\x13BitTorrent\x20protocol,\x00\x00\x00\x00\x00”	“^(\x13bittorrent protocol\|...”truncated
FTP	“220\x20,USER\x20\”\|“USER\x20anonymous\x0d\x0a”	“QUIT\x20\x0d\x0a”\|“PASS\x20”\|“USER\x2 0”\|“220\x20”	“^220[\x09-\x0d -~]*ftp”
		\|“USER\x20anonymous\x0d\x0a”\|…(6signat ures)
POP3	“-ERR\x20”\|“+OK\x20”	“USER\x20+PASS\x20”\|“erver,+OK\x20”\|...(7signatures)	^(\+ok \|-err )
SMT P	“HELO”\|“MAIL\x20FROM:”\|“RCPT\x20TO:”\|“DATA\x0d\x0a”\|\|“250\0x20,QUIT\x0d\x0a”	No test the application protocol	“^220[\x09-\x0d-~]*(e?smtp\|simplemail)”
MSN	“VER\x20”\|“MSG\x20”\|“CVR\x20”\|“USR\x20”	“ANS\x20,mail.com”\|“mail.com,OUT\x0d\x 0a”\|“\x0d\x0aC”\|”MSG\x20”\|“BYE\x20,mail.com”\|”ANS\x20,\x20OK\x0d\x0a”\|…(7signatures)	“ver[0-9]+msnp[1-9][0-9]?[\x09-\x0d-~]*cvr0\x0d\x0a$\|usr1[!-~]+[0-9]+\x0d\x0a$\|ans 1[!-~]+[0-9]+\x0d\x0a$”
注：特征之间用符号“\|”隔开，特征内的元素之间用逗号(“,”)隔开，不可打印的字节值用“\xff”表示，其中，ff为2个数字的十六进制值。

自适应网络应用特征发现方法

Adaptive extraction method of network application signatures

在线阅读

PDF下载

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 12

参考文献 16

相关文章 3

Metrics

推荐阅读 0

[1]	李湘,陈宁江,杨尚林,李华. 感知应用特征与网络带宽的虚拟机在线迁移优化策略[J]. 通信学报, 2017, 38(Z2): 147-155.
[2]	高长喜,吴亚飚,王枞. 基于抽样分组长度分布的加密流量应用识别[J]. 通信学报, 2015, 36(9): 65-75.
[3]	王变琴1,2，余顺争1. 自适应网络应用特征发现方法[J]. 通信学报, 2013, 34(4): 15-137.