Bitstream Protocol Classification Mechanism Based on Feature Extraction

Wang, Wei; Bai, Binbin; Wang, Yichuan; Hei, Xinhong; Zhang, Li

doi:10.1109/nana.2019.00050

Cited by 6 publications

(3 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…e amount of data has a significant impact on the quality of the protocol specification, but multiple sequence matching has exponential complexity because sequence matching algorithms use only two messages at a time as input [29]. Zhang et al [30][31][32] studied and proposed a feature extraction method combining multipattern matching and association rules by investigating the bitstream protocol feature extraction technique to divide the bitstream protocol multiprotocol data frames into single-protocol data frames. e work is done for offline data, which cannot meet the real-time nature of bitstream data analysis and identification.…”

Section: Related Workmentioning

confidence: 99%

From Unknown to Similar: Unknown Protocol Syntax Analysis for Network Flows in IoT

Wang

Hei

et al. 2021

Security and Communication Networks

Self Cite

View full text Add to dashboard Cite

Internet of Things (IoT) is the development and extension of computer, Internet, and mobile communication network and other related technologies, and in the new era of development, it increasingly shows its important role. To play the role of the Internet of Things, it is especially important to strengthen the network communication information security system construction, which is an important foundation for the Internet of Things business relying on Internet technology. Therefore, the communication protocol between IoT devices is a point that cannot be ignored, especially in recent years; the emergence of a large number of botnet and malicious communication has seriously threatened the communication security between connected devices. Therefore, it is necessary to identify these unknown protocols by reverse analysis. Although the development of protocol analysis technology has been quite mature, it is impossible to identify and analyze the unknown protocols of pure bitstreams with zero a priori knowledge using existing protocol analysis tools. In this paper, we make improvements to the existing protocol analysis algorithm, summarize and learn from the experience and knowledge of our predecessors, improve the algorithm ideas based on the Apriori algorithm idea, and perform feature string finding under the idea of composite features of CFI (Combined Frequent Items) algorithm. The advantages of existing algorithm ideas are combined together to finally propose a more efficient OFS (Optimal Feature Strings) algorithm with better performance in the face of bitstream protocol feature extraction problems.

show abstract

Section: Related Workmentioning

confidence: 99%

From Unknown to Similar: Unknown Protocol Syntax Analysis for Network Flows in IoT

Wang

Hei

et al. 2021

Security and Communication Networks

Self Cite

View full text Add to dashboard Cite

show abstract

“…By using a feature selection technique, Singh [15] proposed an unsupervised clustering method for unknown protocols classification, where a higher performance than K-means clustering accuracy was achieved. Ma and Qin [16] used the convolutional network to identify unknown protocols and treated the network flow load as image data, while Wang et al [17] proposed a zeroknowledge classification model for unknown protocols in a bit stream. Jung and Jeong [18] considered a system where a deep belief network was combined and then proposed an extraction algorithm to realize the classification of unknown protocols based on average histogram features.…”

Section: Introductionmentioning

confidence: 99%

An Unknown Protocol Identification Method for Industrial Internet

Zhu

Jiang

Zhang

et al. 2022

Wireless Communications and Mobile Computing

View full text Add to dashboard Cite

This paper focuses on the problem of protocol identification in the industrial internet and proposes an unknown protocol identification method. We first establish an industrial internet protocol detection model to classify known protocols, unknown protocols, and interference signals and then store the unknown protocols for manual analysis. Based on the Eps-neighborhood idea, we further develop an Eps-neighborhood hit algorithm and propose an identification method to identify unknown protocols, where the supervised learning classification of unknown protocol detection is realized. Finally, extensive experimental results are provided to illustrate our theoretical findings. It indicates that the proposed method has an average screening accuracy of 94.675% and 95.159% for unknown protocols encoded in binary and ASCII, respectively, while the average screening accuracy of known protocols in binary and ASCII encoding is 94.242% and 94.075%.

show abstract

“…In [6], the authors studied the protocol identification method for spatial link layer protocol. Second, the traditional protocol identification methods are based on the data-level protocol [7]. However, the data-level protocol needs to be demodulated and decoded after receiving the wireless signal, which is difficult when lacking of prior information [8].…”

Section: Introductionmentioning

confidence: 99%

Deep Learning Based Identification Method for Signal-Level Wireless Protocol

Ren

Song

et al. 2022

IEEE Access

View full text Add to dashboard Cite

Electromagnetic spectrum surveillance is the basis of space environment monitoring and management, while protocol identification is one of the most important methods. Protocol identification has been applied in many fields, such as target recognition, anomaly detection, security management and information countermeasure. In the past decade, a lot of deep learning based protocol identification methods have been proposed, based on the bit-level protocol. However, the data needs to be demodulated and decoded, depending on the prior information of the target system. In this paper, we focus on signal-level protocol, and introduce the deep learning based identification method. We first develop a multi-dimensional convolutional neural network based method for feature extraction of signal-level protocol. Then, a spatial pooling convolutional neural network is introduced for variable length protocol identification. At last, an unsupervised training network is proposed for feature extraction of unlabelled signal-level protocol. The proposed methods are evaluated by using the practical wireless protocols, and the effectiveness is verified by simulation results.

show abstract

Bitstream Protocol Classification Mechanism Based on Feature Extraction

Cited by 6 publications

References 16 publications

From Unknown to Similar: Unknown Protocol Syntax Analysis for Network Flows in IoT

From Unknown to Similar: Unknown Protocol Syntax Analysis for Network Flows in IoT

An Unknown Protocol Identification Method for Industrial Internet

Deep Learning Based Identification Method for Signal-Level Wireless Protocol

Contact Info

Product

Resources

About