自适应网络应用特征发现方法

doi:10.3969/j.issn.1000-436x.2013.04.015

Abstract

Abstract:

An adaptive application signature extraction method (AdapSig) was proposed.AdapSig firstly extracted keyword sequences from payloads of packets,and then negative examples and redundancy filter were used to generate candidate signatures.An adaptive mechanism based on self-identification rate was applied to select the final si ture.Experimental results show that application signatures extracted by AdapSig have high accuracy for various protocols.

Key words: application signature, keyword minging, adaptive signature extraction, application identification

Bian-qin WANG,Shun-zheng YU. Adaptive extraction method of network application signatures[J]. Journal on Communications, 2013, 34(4): 127-137.

Figures/Tables 12

References 16

[1]	Internet assigned numbers authority(IANA)[EB/OL]. , 2012.
[2]	BERNAILLE L , TEIXEIRA R , AKODKENKUT I , et al. Traffic classification on the fly[J]. ACM SIGCOMM Computer Communication Review, 2006,36(2): 23-26.
[3]	CROTTI M , DUSI M , GRINFOLI F , et al. Traffic classification through simple statistical fingerprinting[J]. ACM SIGCOMM Computer Communication Review, 2007,37(1): 1-16.
[4]	SEN S , SPATSCHECK O , WANG DM . Accurate,scalable in-network identification of P2P traffic using application signat[A]. Proceedings of WWW2004[C]. New York,USA, 2004. 512-521.
[5]	Application layer packet classifier for linux[EB/OL]. , 2012.
[6]	HAFFNER P , SEN S , SPATSCHECK O , et al. ACAS:automated construction of application signatures[A]. Proceedings of ACM SIGCOMM MineNet Workshop[C]. Philadelphia,USA, 2005. 197-202.
[7]	MA J , LEVCHENKO K , KREIBICH C , et al. Unexpected means of protocol inference[A]. Proceedings of the 6th ACM SIGCOMM conference on Internet measurement[C]. Rio de Janeriro,Brazil, 2006. 313-326.
[8]	PARK B C , WON Y J , KIM M S , et al. Towards automated application signature generation for traffic identification[A]. Proceedings of the IEEE/IFIP Network Operations and Management Symposium[C]. Salvador,Bahia,Brazil, 2008. 160-167.
[9]	WANG Y , XIANG Y , ZHOU W L , et al. Generating regular expression signatures for network traffic classification in trusted network management[J]. Journal of Network and Computer Applications, 2011,17: 1-9.
[10]	赵咏, 姚秋林, 张志斌等． TPCAD：一种文本类多协议特征自动发现方法[J]．通信学报, 2009,30(10A):28-35. ZHAO Y , YAO Q L , ZHANG Z B , et al. TPCAD:a text-oriented multi-protocol inference approach[J]. Journal on Communications, 2009,30(10A):28-35.
[11]	刘兴彬, 杨建华, 谢高岗等. 基于Apriori算法的流量识别特征自动提取方法[J]．通信学报, 2008,29(12):51-59. LIU X B , YANG J H , XIE G G , et al. Automated mining of packet signatures for traffic identification at application layer with Apriori algorithm[J]. Journal on Communications, 2008,29(12):51-59.
[12]	AGRAWAL R , SRIKANT R . Fast algorithms for mining assoc ion rules[A]. Proceedings of the 20th International Conference on Very Large Data Bases[C]. San Francisco,CA,USA, 1994. 487-499.
[13]	龙文, 马坤, 辛阳等. 适用于协议特征提取的关联规则改进算法[J]. 电子科技大学学报， 2010,39(2):302-305. LONG W , MA K , XIN Y , et al. Improved association rules algorithm for protocol signatures extracting[J]. Journal of University of Electronic Science and Technology of China, 2010,39(2):302-305.
[14]	YE M J , XU K , WU J P , et al. AutoSig-automatically generating signatures for applications[A]. IEEE Ninth International Conference on Computer and Information Technology[C]. Xiamen,China, 2009. 104-109.
[15]	HAN J , PEI J , YIN Y . Mining frequent patterns without ndidate generatio[A]. Proceedings of the 2000 ACM SIGMOD[C]. Dalas,TX,USA, 2000. 1-11.
[16]	AGRAWAL R , SRIKANT R . Mining sequential patterns[A]. Proceedings of the Eleventh International Conference on Data Engineering[C]. 1995. 3-14.

Metrics

Recommended 0

No Suggested Reading articles found!

协议	会话数量	分组数量	容量/Mbyte
HTTP	880	57 568	77.2
FTP	920	20 616	102.24
SMTP	652	32 884	60.32
POP3	512	600 072	72.8
MSN	556	52 460	18.52
BT	1 184	297 594	44.7

协议	本文的AdapSig 获得的精简特征	AutoSig 获得的特征	L7-filter 的特征 (RegExp)
HTTP	“GET\x20/”\|“HTTP/1.”	“HTTP/1.”\|“GET\x20/,HTTP/1.”	“http/(0\.9\|1\.0\|1\.1)[1-5][0-9][0-9][\x09-\x0d -~]…\|post[\x09-\x0d -~]…”truncated
BT	“\x13BitTorrent\x20protocol”	“\x13BitTorrent\x20protocol,\x00\x00\x00\x00\x00”	“^(\x13bittorrent protocol\|...”truncated
FTP	“220\x20,USER\x20\”\|“USER\x20anonymous\x0d\x0a”	“QUIT\x20\x0d\x0a”\|“PASS\x20”\|“USER\x2 0”\|“220\x20”	“^220[\x09-\x0d -~]*ftp”
		\|“USER\x20anonymous\x0d\x0a”\|…(6signat ures)
POP3	“-ERR\x20”\|“+OK\x20”	“USER\x20+PASS\x20”\|“erver,+OK\x20”\|...(7signatures)	^(\+ok \|-err )
SMT P	“HELO”\|“MAIL\x20FROM:”\|“RCPT\x20TO:”\|“DATA\x0d\x0a”\|\|“250\0x20,QUIT\x0d\x0a”	No test the application protocol	“^220[\x09-\x0d-~]*(e?smtp\|simplemail)”
MSN	“VER\x20”\|“MSG\x20”\|“CVR\x20”\|“USR\x20”	“ANS\x20,mail.com”\|“mail.com,OUT\x0d\x 0a”\|“\x0d\x0aC”\|”MSG\x20”\|“BYE\x20,mail.com”\|”ANS\x20,\x20OK\x0d\x0a”\|…(7signatures)	“ver[0-9]+msnp[1-9][0-9]?[\x09-\x0d-~]*cvr0\x0d\x0a$\|usr1[!-~]+[0-9]+\x0d\x0a$\|ans 1[!-~]+[0-9]+\x0d\x0a$”
注：特征之间用符号“\|”隔开，特征内的元素之间用逗号(“,”)隔开，不可打印的字节值用“\xff”表示，其中，ff为2个数字的十六进制值。

Adaptive extraction method of network application signatures

RichHTML

PDF

Knowledge

Cited

Abstract

Cite this article

share this article

Figures/Tables 12

References 16

Related Articles 2

Metrics

Recommended 0

[1]	Chang-xi GAO,Ya-biao WU,Cong WANG. Encrypted traffic classification based on packet length distribution of sampling sequence [J]. Journal on Communications, 2015, 36(9): 65-75.
[2]	. Adaptive extraction method of network application signatures [J]. Journal on Communications, 2013, 34(4): 15-137.