Unknown Bit Stream Protocol Message Discovery with Zero Knowledge

Zhang, Fengli; Zhang, Junjiao; Zhou, Hongchuan

doi:10.1007/978-3-319-27161-3_73

Cited by 2 publications

(2 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There are no significant achievements in the analysis of such protocols in current studies. Zhang et al [29] only recognized the address field in the message format, and Zheng et al [30] could not identify the message types of the protocol.…”

Section: Related Workmentioning

confidence: 99%

“…In the experimental section, the proposed protocol identification results were compared with the method proposed by Zhang [29]. Zhang's method is also used for unknown bitstream protocols, which discovers protocols by frequent sequences and positions based on clustering and detects address fields based on the similarity of the unit set in different positions.…”

Section: ) Algorithm Comparisonmentioning

confidence: 99%

See 1 more Smart Citation

Association Analysis and Identification of Unknown Bitstream Protocols Based on Composite Feature Sets

et al. 2021

View full text Add to dashboard Cite

Concomitant with the rapid development of network communications technology, the analysis of communication protocols has become indispensable in the maintenance of daily network security.Common protocol analysis methods predominantly analyze protocols using known information, such as fixed port numbers; however, these methods have significant limitations. In the current network environment, the proportion of undisclosed protocols is increasing daily, and the information related to such protocols is difficult to obtain and sometimes fails because of the particularity of the unknown protocol format. Therefore, it is crucial to analyze unknown protocols in the context of less prior knowledge. To solve this problem, this paper proposes a novel protocol identification method in which association analysis and identification of unknown bitstream protocols are first carried out based on composite feature sets. Furthermore, data mining and statistics-related knowledge are applied to realize protocol message-type identification and protocol message-format analysis. The results of experiments conducted on the bitstream protocol dataset verify that the proposed method can accurately identify different message types. Specifically, taking the ICMP and ARP protocols as examples, the proposed method could effectively infer the main features, which is helpful for further protocol information extraction and analysis.INDEX TERMS Composite feature set, network communication technology, protocol message-format analysis, protocol message-type identification.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: ) Algorithm Comparisonmentioning

confidence: 99%