Statistical-Entropy Method for Zero Knowledge Network Traffic Analysis Algorithm Implementation

摘要

The article is devoted to traffic analysis with zero knowledge about its structure. As a result of combining existing entropy and statistical algorithms, a statistical-entropy method has been developed capable of distinguishing network nodes and significant fields from traffic with unknown protocol. The decision about significant fields boundaries in the analyzed traffic sample made by the algorithm is based on the entropy of individual bytes and byte pairs mutual information. The statistical algorithm determines network addresses using estimate number of occurrences parts of a network packet similar (as a strings) to parts of a previously received array of network traffic. The mathematical models each of the algorithms are implemented as a module of the program that implements the statistical-entropy method. As a result of the software implementation of the described statistical-entropy method, network addresses are allocated from the network traffic with zero knowledge about the protocols used in it, and separation into semantic fields is proposed.