一种基于隐马尔可夫模型的协议识别技术

目前的协议识别技术主要是基于端口映射或静态报文特征匹配的。随着网络协议的发展,一些新的协议采用动态端口进行通信或不具有明显的静态报文特征,且部分协议采用了加密技术。这使得传统的识别技术准确率大幅下降。针对传统协议识别技术的局限性,这里提出一种基于隐马尔可夫模型(Hidden Markov Model,HMM)的协议识别技术。它是一种基于统计特性的识别方法,选用对于加密不敏感的特征如包的大小、达到时间等来实现协议的识别。实验结果证明,与传统识别技术相比,它能有效地提高协议识别的准确率,并能用于加密条件下的协议识别。

Technique of Protocol Identification Using Profile Hidden Markov Model

Recently,protocol identification techniques are mostly based on port mapping or static characters matching.With the development of network protocols,some new protocols use dynamic pots or messages without obvious static characters,or some protocols are encrypted.These make the accuracy with traditional identification techniques significantly reduced.Considering the limits of traditional techniques,this paper proposes a protocol identification technique using Profile Hidden Markov Model(HMM).It is based on statistic characteristics and selects those features that remain intact after encryption such as packet sizes,arrival times etc.Experiment results show that compared with traditional techniques,it can substantially increase recognition accuracy and can be applied in encrypted environment.