Protocol State Based Active Probing Method for Detecting Applications of Proprietary Protocol

摘要

Network traffic classification and unknown network application identification have become new challenges for network regulators and traffic inspection organizations. In this paper, in order to identify applications of proprietary protocol from the complex network environment, an active probing method based on protocol state is proposed in this paper. Based on the analysis of traffic characteristic and instruction trajectory of the application of proprietary protocol, this paper makes an in-depth study on the encryption and version features of the proprietary application by actively sending probing packets with special formats. The proprietary application studied in this paper is built in the VPS. Network packet analysis tools are used to extract traffic characteristics. We design the probe according to the characteristics. The experimental results show that the proposed active probing method based on protocol state is successful in detecting the application of proprietary protocol.