论文部分内容阅读
为解决网络协议语法分析方法中,依赖人工干预、分析效率低下、分析范围较小等问题,提出一种基于相似度匹配的网络协议语法分析方法.通过嗅探采集网络原始数据包,解析基础协议并对数据包进行预处理,提取9维不同角度的特征,建立了网络协议语法相似分析模型,分析网络协议细节语法特征.通过将TCP协议作为已知协议,对UDP、DNS、QQ等3种不同类型的协议测试,结果表明这3类协议报头中,33%以上的字段能在TCP协议中找到对应的相似语法,而且平均准确率均在96%以上,该方法不需人工干预,可以提高分析效率、减少限制条件、扩大分析范围,并能较为有效地分析出网络协议语法特征.
In order to solve the problems of network protocol syntax analysis, such as artificial intervention, inefficient analysis and small scope of analysis, this paper proposes a syntax analysis method of network protocol based on similarity matching, collects the original data packets through sniffing, analyzes the basic protocol And preprocessing the data packet to extract features of different angles in nine dimensions and establish a similarity analysis model of network protocol syntax to analyze the grammatical features of the details of the network protocol.Through TCP protocol as a known protocol, UDP, DNS, QQ and other three Different types of protocol tests show that more than 33% of the three types of protocol headers can find corresponding similar syntaxes in the TCP protocol, and the average accuracy rates are all above 96%. This method can be improved without human intervention Analyze efficiency, reduce restrictions, expand the scope of analysis, and analyze the grammatical features of network protocols more effectively.