.png){kind=icon}
返回
A progressive learning method on unknown protocol behaviors
.png){kind=icon}
PRE
AI
DOI：10.1016/j.jnca.2021.103249.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Reverse analyzing of unknown protocol behaviors keeps being a tough nut in Protocol Reverse Engineering (PRE), which infers specifications of unknown protocols by observable information, especially when only transmitted messages are available. This paper proposes a novel protocol state machine model Stochastic Protocol finite-state Transducer (SPT) to describe the message interaction rules between communicating terminals in a probabilistic way attempting to simulate behavior rules of unknown protocols in certain implementation. Together with a state related field recognition and compensation method, a progressive SPT learning algorithm of unknown protocols named Sptia-PL, is designed and implemented to reconstruct the SPT of target protocol with the ability to predict succeeding behaviors. By updating the SPT progressively, the proposed method is able to learn continuously in linear time and remain the established model in optimal condition during the whole learning process. This strategy thoroughly avoids the state explosion problem existing in most state machine learning methods of PRE. Experiments on two open and three local collected datasets of FTP, SMTP and POP3 prove the rationality of SPT model and effectiveness of Sptia-PL algorithm by an average Accuracy over 0.94 and a Coverage close to 0.99. The small computing cost O(N) of this method and high confidence of results outperforms all the known state-of-the-art methods significantly.
Keyword:
Protocol reverse engineering
State machine learning
Finite state transducer
State explosion problem
期刊
IF:
8
论文数:
3.7K
被引数:
1.1W
机构
引用论文
.png){kind=icon}
An Industrial Network Intrusion Detection Algorithm Based on Multifeature Data Clustering Optimization Model基于多特征数据聚类优化模型的工业网络入侵检测算法
PREAI
分享收藏分享收藏分享收藏
查看更多内容