基于半监督子空间聚类的协议识别方法

针对现有的基于统计特征的协议识别方法选择识别特征时未考虑不同协议个体之间的差异的问题，结合半监督学习和模糊子空间聚类（FSC）方法，提出了一种半监督子空间聚类协议识别方法（SSPIA）。首先，将有标签的样本流转化为成对约束信息，从而获取先验约束条件；其次，在此基础上提出半监督模糊子空间聚类（SFSC）算法，该算法利用约束条件指导子空间聚类过程；然后，建立类簇和协议类型的映射，以获取协议各个特征的权重系数，进而构建个体化的密码协议特征库用于后续协议识别；最后，针对5个典型的密码协议进行聚类效果和识别效果实验。实验结果表明，针对基于统计特征的协议识别问题，与传统K-means方法和FSC方法相比，所提SSPIA的聚类效果更好，且SSPIA构建的协议识别分类器更为精确，协议识别率更高，误识别率更低。所提SSPIA提高了基于统计特征的识别效果。

Protocol identification approach based on semi-supervised subspace clustering

The differences between different protocols are not considered when selecting identification features in the existing statistical feature-based identification methods. In order to solve the problem, a Semi-supervised Subspace-clustering Protocol Identification Approach (SSPIA) was proposed by combining semi-supervised learning and Fuzzy Subspace Clustering (FSC) method. Firstly, the prior constraint condition was obtained by transforming the labeled sample flow into pairwise constraints information. Secondly, the Semi-supervised Fuzzy Subspace Clustering (SFSC) algorithm was proposed on this basis and was used to guide the process of subspace clustering by using the constraint condition. Then, the mapping between class clusters and protocol types was established to obtain the weight coefficient of each protocol feature, and an individualized cryptographic protocol feature library was constructed for subsequent protocol identification. Finally, the clustering effect and identification effect experiments of five typical cryptographic protocols were carried out. Experimental results show that, compared with the traditional K-means method and FSC method, the proposed SSPIA has better clustering effect, and the protocol identification classifier constructed by SSPIA is more accurate, has higher protocol identification rate and lower error identification rate. The proposed SSPIA improves the identification effect based on statistical features.