基于数据流前端检测的快速协议识别

信息战都追求高速反应机动,对网络协议识别提出了高效快速的要求。基于深度包检测DPI的协议识别方法识别准确率高,但是由于要对所有数据包进行检测,计算量很大。基于端口号的协议识别方法速度快,但识别准确率低。提出一种新的基于数据流前端检测的协议识别方法并进行了系统实现,结合了基于端口方法的快速简单和基于DPI的准确性的优点。实验表明,这种综合快速协议识别方法识别准确率高,与基于DPI的方法相比,识别时间减少将近80%。

Fast protocol identification based on data-flow front-end detection

With the demand of quick response capability in the information war,the network protocol identification needs to be efficient and quick. The protocol identification method based on deep packet inspection（DPI）can achieve high accuracy, however it brings about mass calculation because of inspection of all packets. The protocol identification method based on port inspection is fast,but its accuracy is low. A new protocol identification method based on dataflow frontend detection is proposed and the system implementation way is given in this paper. The simple fast advantage of portbased method and the accuracy advantage of DPI method are combined in this method. The experimental results show that the new protocol identification method can achieve high accuracy,and decrease the identification time by nearly 80% in comparison with the DPI methods.