基于特征加权与最近邻法的P2P协议识别算法

针对新的P2P协议以及加密P2P协议无法使用传统方法进行识别的问题,提出一种新的基于流量统计特征的识别方法。首先定义了网络协议特征矢量的概念,并在此基础上使用类内、类间距离与遗传算法定量地对特征子集进行选择,同时由于不同属性所起的作用不同,提出了网络协议特征加权的概念,并使用粒子群优化算法计算特征权值。为了提高识别率,针对TCP协议与UDP协议分别建立了相应的特征空间。实验结果表明该方法能够有效地从多种属性特征中选择出最能够体现P2P协议之间以及P2P协议与非P2P协议之间区别的特征子集,且通过粒子群优化算法计算出的特征权值使识别率得到提高。实验证明通过该算法,对常见的P2P协议平均识别率达到了96%。

P2P Protocol Identification Algorithm Based on Feature Weighting and Nearest Neighbor Methods

In order to solve the problem that emerging and encrypted P2P protocols cannot be classified by traditional methods, a new efficient P2P identification algorithm based on the flow statistical characteristics was proposed. The concept of network protocol feature vector was defined at first, and then the feature subclass was selected using the neighbor distance and genetic algorithm. Due to the role of different attributes, the concept of network protocol feature weighting was proposed and calculated by particle swarm optimization. In order to improve the identification rate, the corresponding feature space was established respectively for TCP and UDP protocols. Experimental results showed that this method could effectively select the subclass from multiple attributes that could most reflect the difference among P2P protocols and also between P2P and non-P2P protocols. The identification rate was improved by feature weighting calculated by particle swarm optimization. In this algorithm, the identification rate of popular P2P protocols reached to 96%.