Analyze Network Protocol's Hidden Behavior

Hu, Yan-Jing; Pang, Liaojun; Pei, Qingqi; Wang, Xu An

doi:10.1109/3pgcic.2015.68

Cited by 1 publication

(1 citation statement)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…e three basic elements of network protocols are semantics, syntax, and timing. e inference of the protocol message format and the determination of its field contents belong to the protocol syntax analysis [20]. e analysis and extraction of protocol syntax is the basis of protocol analysis and identification.…”

Section: Introductionmentioning

confidence: 99%

From Unknown to Similar: Unknown Protocol Syntax Analysis for Network Flows in IoT

Wang

Hei

et al. 2021

Security and Communication Networks

View full text Add to dashboard Cite

Internet of Things (IoT) is the development and extension of computer, Internet, and mobile communication network and other related technologies, and in the new era of development, it increasingly shows its important role. To play the role of the Internet of Things, it is especially important to strengthen the network communication information security system construction, which is an important foundation for the Internet of Things business relying on Internet technology. Therefore, the communication protocol between IoT devices is a point that cannot be ignored, especially in recent years; the emergence of a large number of botnet and malicious communication has seriously threatened the communication security between connected devices. Therefore, it is necessary to identify these unknown protocols by reverse analysis. Although the development of protocol analysis technology has been quite mature, it is impossible to identify and analyze the unknown protocols of pure bitstreams with zero a priori knowledge using existing protocol analysis tools. In this paper, we make improvements to the existing protocol analysis algorithm, summarize and learn from the experience and knowledge of our predecessors, improve the algorithm ideas based on the Apriori algorithm idea, and perform feature string finding under the idea of composite features of CFI (Combined Frequent Items) algorithm. The advantages of existing algorithm ideas are combined together to finally propose a more efficient OFS (Optimal Feature Strings) algorithm with better performance in the face of bitstream protocol feature extraction problems.

show abstract

Section: Introductionmentioning

confidence: 99%