基于抽象解释的数据迷惑正确性分析

随着网络的高速发展和协议的复杂化,传统的基于端口号和特征串的应用层协议识别算法的识别率已明显下降。基于协议统计特征的模式识别方法应运而生,文章提出了一种基于隐马尔可夫模型的协议识别技术,选取包长、包到达时间间隔、包传输方向等数据包外部特征组成特征矢量,避免了对数据具体内容的解析;引入了增量学习的思想,实现了对未知协议的主动学习。实验结果显示,该算法对于控制报文和数据报文均加密的应用层协议同样有很好的识别效果,识别率达到了90%以上。

Evaluating the Correctness of Data Obfuscation by Abstract Interpretation

With the rapid development of networks and increasing complexity of new protocols,traditional portbased and payload-based application-layer protocol identification methods are falling behind with poor identification performance.So patlern-matching identification methods based on statistical characteristics have become popular.This paper p roposes a protocol identification technique using Hidden Markov Model(HMM),whose characteristic oector consists of packet external properties such as packet sizes,inter-ar...