• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>IEEE International Conference on Network Protocols >Rethinking Robust and Accurate Application Protocol Identification: A Nonparametric Approach
【24h】

Rethinking Robust and Accurate Application Protocol Identification: A Nonparametric Approach

机译：重新思考强大和准确的应用协议识别：非参数方法

获取原文
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Protocol traffic analysis is important for a variety of networking and security infrastructures, such as intrusion detection and prevention systems, network management systems, and protocol specification parsers. In this paper, we propose ProHacker, a nonparametric approach that extracts robust and accurate protocol keywords from network traces and effectively identifies the protocol trace from mixed Internet traffic. ProHacker is based on the key insight that the n-grams of protocol traces have highly predictable statistical nature that can be effectively captured by statistical language models and leveraged for robust and accurate protocol identification. In ProHacker, we first extract protocol keywords using a nonparametric Bayesian statistical model, and then use the corresponding protocol keywords to classify protocol traces by a semi-supervised learning algorithm. We implement and evaluate ProHacker on real-world traces, including SMTP, FTP, PPLive, SopCast, and PPStream, and our experimental results show that ProHacker can accurately identify the protocol trace with an average precision of about 99.42% and an average recall of about 98.64%. We also compare the results of ProHacker to two state-of-the-art approaches ProWord and Securitas using backbone traffic. We show that ProHacker provides significant improvements on precision and recall for online protocol identification.
机译：协议流量分析对于各种网络和安全基础架构非常重要，例如入侵检测和预防系统，网络管理系统和协议规范解析器。在本文中，我们提出了一种非参数方法，这是一种从网络迹线中提取强大和准确的协议关键字的非参数方法，并有效地识别来自混合互联网流量的协议跟踪。 Prohacker基于关键洞察力，即协议迹线的N-GRAM具有高度可预测的统计性质，可以通过统计语言模型有效地捕获并利用鲁棒和准确的协议识别。在Prohacker中，我们首先使用非参数贝叶斯统计模型提取协议关键字，然后使用相应的协议关键字通过半监督学习算法对协议跟踪进行分类。我们在现实世界迹线上实施和评估Prohacker，包括SMTP，FTP，PPLive，Sopcast和PPStream，我们的实验结果表明，Prohacker可以准确地识别平均精度约为99.42％的协议迹线和普通召回98.64％。我们还将Prohacker的结果与两个最先进的方法使用骨干交通进行了普罗旺斯和Securitas的结果。我们展示了Prohacker对在线协议识别的精度和回忆中提供了显着的改进。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号