基于分类与特征匹配的应用层协议识别方法

摘要

According to monitoring and analysis of application layer data by network security monitoring, the traditional port-based, load and keywords application layer protocol identification methods are no longer applicable, the paper designs an application layer protocol identification method based on the classification and characteristics matching. Its core idea is to propose the classification decision rule at first and to classify the data flow needed to be identified in a coarse-grained level based on decision rules, then to take a different protocol feature matching for different data streams, in order to identify more intrusion and to improve the speed of feature identification. According to the comparison between the simulation results and other identification methods the execution efficiency of the proposed method is better than other identification methods.%针对网络安全监控对应用层数据的监测与分析,传统的基于端口、负载和关键字的应用层协议识别法不再适用,提出了一种基于分类和特征匹配的应用层协议识别法.其核心思想是先提出分类的判定规则,对待识别的数据流依据判定规则进行一个粗粒度的分类,针对不同的数据流采取不同的协议特征匹配,从而达到识别更多入侵行为以及提高特征识别速度的目的.将仿真结果与其他识别法进行比较,表明了该方法的执行效率优于其他识别法.