基于自编码器的未知协议分类方法

doi:10.11959/j.issn.1000-436x.2020123

Abstract

Abstract:

Aiming at the problem that a large number of unknown protocols exist in the Internet,which makes it very difficult to manage and maintain the network security,a classification and identification method of unknown protocols was proposed.Combined with the autoencoder technology and the improved K-means clustering technology,the unknown protocol was classified and identified for the network traffic.The autoencoder was used to reduce dimensionality and select features of network traffic,clustering technology was used to classify the dimensionality reduction data unsupervised,and finally unsupervised recognition and classification of network traffic were realized.Experimental results show that the classification effect is better than the traditional K-means,DBSCAN,GMM algorithm,and has higher efficiency.

Key words: unknown protocol classification, autoencoder, unsupervised classification, feature extraction

CLC Number:

TP181

Chunxiang GU,Weisen WU,Ya’nan SHI,Guangsong LI. Method of unknown protocol classification based on autoencoder[J]. Journal on Communications, 2020, 41(6): 88-97.

Figures/Tables 14

References 31

[1]	吴礼发, 洪征, 潘瑶 . 网络协议逆向分析及应用[M]. 北京: 国防工业出版社, 2016.
	WU L F , HONG Z , PAN Y . Network protocol reverse analysis and application[M]. Beijing: National Defense Industry PressPress, 2016.
[2]	ANDERSON B , MCGREW D . Machine learning for encrypted malware traffic classification:accounting for noisy labels and non-stationarity[C]// Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. New York:ACM Press, 2017: 1723-1732.
[3]	HINTON G , SALAKHUTDINOV R . Reducing the dimensionality of data with neural networks[J]. Science, 2006,313(5786): 504-507.
[4]	QI Y , XU L , YANG B ,et al. Packet classification algorithms:from theory to practice[J]. Proceedings - IEEE INFOCOM, 2009,13(10): 648-656.
[5]	FIVOS C , PANAYIOTIS M . Identifying known and unknown peer-to-peer traffic[C]// Proceedings of IEEE International Symposium on Network Computing ＆ Applications. Piscataway:IEEE Press, 2006: 93-102.
[6]	THAY C , VISOOTTIVISETH V , MONGKOLLUKSAMEE S . P2P traffic classification for residential network[C]// Computer Science ＆Engineering Conference. Piscataway:IEEE Press, 2016: 1-6.
[7]	CHUNG J , PARK B , WON Y ,et al. Traffic classification based on flow similarity[C]// IEEE International Workshop on IP Operations ＆Management. Berlin:Springer, 2009: 65-77.
[8]	ROCHA E , SALVADOR P , NOGUEIRA A . Detection of illicit network activities based on multivariate Gaussian fitting of multi-scale traffic characteristics[C]// 2011 IEEE International Conference on Communications. Piscataway:IEEE Press, 2011: 1-6.
[9]	TAYLOR V , SPOLAOR R , CONTI M ,et al. Robust smartphone App identification via encrypted network traffic analysis[J]. IEEE Transactions on Information Forensics ＆ Security, 2017,13(1): 63-78.
[10]	BLAKE A , SUBHARTHI P , DAVID M . Deciphering malware’s use of TLS (without decryption)[J]. arXiv Preprint,arXiv:1607.01639, 2017
[11]	WANG W , ZHU M , ZENG X , ,et al. Malware traffic classification using convolutional neural network for representation learning[C]// 2017 International Conference on Information Networking. Piscataway:IEEE Press, 2017: 712-717.
[12]	YANG Y , KANG C , GOU G ,et al. TLS/SSL encrypted traffic classification with autoencoder and convolutional neural network[C]// 2018 IEEE 20th International Conference on High Performance Computing and Communications; IEEE 16th International Conference on Smart City; IEEE 4th International Conference on Data Science and Systems (HPCC/SmartCity/DSS). Piscataway:IEEE Press, 2018: 362-369.
[13]	MA R , QIN S . Identification of unknown protocol traffic based on deep learning[C]// 2017 3rd IEEE International Conference on Computer and Communications. Piscataway:IEEE Press, 2017: 1195-1198.
[14]	ZHANG J , CHEN C , XIANG Y ,et al. An effective network traffic classification method with unknown flow detection[J]. IEEE Transactions on Network and Service Management, 2013,10(2): 133-147.
[15]	ZHU P , ZHANG S , LUO H ,et al. A semi-supervised method for classifying unknown protocols[C]// 2019 IEEE 3rd Information Technology,Networking,Electronic and Automation Control Conference. Piscataway:IEEE Press, 2019: 1246-1250.
[16]	ZANDER S , NGUYEN T , ARMITAGE G . Automated traffic classification and application identification using machine learning[C]// IEEE Conference on Local Computer Networks. Piscataway:IEEE Press, 2005： 250-257.
[17]	ERMAN J , ARLITT M , MAHANTI A . Traffic classification clustering algorithms[C]// Proceedings of SIGMETRICS. New York:ACM Press, 2006: 281-286.
[18]	卢政宇, 李光松, 申莹珠 ,等. 基于连续特征的未知协议消息聚类算法[J]. 山东大学学报(理学版), 2019,54(5): 37-43.
	LU Z Y , LI G S , SHEN Y Z ,et al. Clustering algorithm of unknown protocol messages based on continuous features[J]. Journal of Shandong University (Science Edition), 2019,54(5): 37-43.
[19]	DING C , HE X . Cluster structure of K-means clustering via principal component analysis[J]. Lecture Notes in Computer Science, 2004,46(4): 414-418.
[20]	CHEN X , KINGMA D , SALIMANS T ,et al. Variational lossy autoencoder[J]. arXiv preprint arXiv:1611.02731, 2016
[21]	DENG J , ZHANG Z , EYBEN F ,et al. Autoencoder-based unsupervised domain adaptation for speech emotion recognition[J]. IEEE Signal Processing Letters, 2014,21(9): 1068-1072.
[22]	BENGIO Y , LAMBLIN P , POPOVICI D ,et al. Greedy layer-wise training of deep networks[C]// Neural Information Processing Systems. Massachusetts:MIT Press, 2007: 153-160.
[23]	VINCENT P , LAROCHELLE H , BENGIO Y ,et al. Extracting and composing robust features with denoising autoencoders[C]// Machine Learning,Proceedings of the Twenty-Fifth International Conference. New York:ACM Press, 2008: 1096-1103.
[24]	RIFAI S , VINCENT P , MULLER X ,et al. Contractive auto-encoders:explicit invariance during feature extraction[C]// Proceedings of the 28th International Conference on Machine Learning. New York:ACM Press, 2011: 833-840.
[25]	HARTIGAN J , WONG M . Algorithm AS 136:a K-means clustering algorithm[J]. Journal of the Royal Statistical Society.Series C (Applied Statistics), 1979,28(1): 100-108.
[26]	SELIM S , ISMAIL M . K-means-type algorithms:a generalized convergence theorem and characterization of local optimality[J]. IEEE Transactions on Pattern Analysis and Machine Intelligence, 1984,6(1): 81-87.
[27]	LAURENS V , HINTON G . Visualizing data using T-SNE[J]. Journal of Machine Learning Research, 2008,9(2605): 2579-2605.
[28]	MAATEN L . Learning a Parametric embedding by preserving local structure[J]. Journal of Machine Learning Research, 2009(5): 384-391.
[29]	HALKIDI M , VAZIRGIANNIS M . Clustering validity assessment:finding the optimal partitioning of a data set[C]// IEEE International Conference on Data Mining. Piscataway:IEEE Press, 2001:187.
[30]	LIU Y , LI Z , XIONG H ,et al. Understanding of internal clustering validation measures[C]// 2010 IEEE International Conference on Data Mining. Piscataway:IEEE Press, 2010: 911-916.
[31]	HUBERT L , ARABIE P . Comparing partitions[J]. Journal of Classification, 1985,2(1): 193-218.

Metrics

Recommended 0

No Suggested Reading articles found!

数据集	DEC模型/s	K-means/s	DBSCAN/s	GMM/s	PRISMA/s
数据集1	5.662 36	7.325 22	180.059 59	16.448 28	5.876 94
数据集2	4.182 25	4.601 08	27.051 56	8.413 99	4.536 88
数据集3	0.682 61	2.132 34	3.968 55	0.934 93	2.125 45

Method of unknown protocol classification based on autoencoder

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 14

References 31

Related Articles 15

Metrics

Recommended 0

[1]	Feibo JIANG, Yubo PENG, Li DONG. Deep image semantic communication model for 6G [J]. Journal on Communications, 2023, 44(3): 198-208.
[2]	Weigang HUO, Rui LIANG, Yonghua LI. Anomaly detection model for multivariate time series based on stochastic Transformer [J]. Journal on Communications, 2023, 44(2): 94-103.
[3]	Julong LAN, Di ZHU, Dan LI. Intelligent prediction method of virtual network function resource capacity for polymorphic network service slicing [J]. Journal on Communications, 2022, 43(6): 143-155.
[4]	Xiaodan WANG, Jingtai LI, Yafei SONG. DDAC: a feature extraction method for model of image steganalysis based on convolutional neural network [J]. Journal on Communications, 2022, 43(5): 68-81.
[5]	Jie LAI, Xiaodan WANG, Qian XIANG, Yafei SONG, Wen QUAN. Review on autoencoder and its application [J]. Journal on Communications, 2021, 42(9): 218-230.
[6]	Limin XIAO,Xiangrong XU,Zhuangkun WEI,Shenghan LIU,Yiwen LIU. Channel impulse response insensitive feature for non-coherent signal detection in molecular communication [J]. Journal on Communications, 2020, 41(9): 49-58.
[7]	Jingyi QU,Meng YE,Xing QU. Airport delay prediction model based on regional residual and LSTM network [J]. Journal on Communications, 2019, 40(4): 149-159.
[8]	Shan GAI. Feature extraction algorithm based on quaternion common spatial pattern for banknote recognition [J]. Journal on Communications, 2018, 39(12): 40-46.
[9]	Wei-guo SHEN,Wei WANG. Keystroke features recognition based on stable linear discriminant analysis [J]. Journal on Communications, 2017, 38(Z2): 26-29.
[10]	Xiao-lin XU,Xiao-chun YUN,Yong-lin ZHOU,Xue-bin KANG. Online analytical model of massive malware based on feature clusting [J]. Journal on Communications, 2013, 34(8): 146-153.
[11]	. Online analytical model of massive malware based on feature clusting [J]. Journal on Communications, 2013, 34(8): 19-153.
[12]	Run-qiang YAN,Yi-sheng ZHU. Speech endpoint detection based on recurrence rate analysis [J]. Journal on Communications, 2007, 28(1): 35-39.
[13]	Xin-ran LIU. New network attack classification architecture [J]. Journal on Communications, 2006, 27(2): 160-167.
[14]	Chun-yan QIU,Tie-li SUN. Design and implementation of a web-based feature extraction search engine [J]. Journal on Communications, 2005, 26(1A): 284-288.
[15]	Yi LI,Qiu-qi RUAN. Texture classification by support vector machines [J]. Journal on Communications, 2005, 26(1): 114-119.