A nonparametric approach to the automated protocol fingerprint inference

作者：Wang, YiPeng; Yun, Xiaochun; Zhang, Yongzheng^*; Chen, Liwei; Wu, Guangjun

来源：Journal of Network and Computer Applications, 2017, 99: 1-9.

DOI：10.1016/j.jnca.2017.10.009

• Protocol fingerprints
• Network traffic
• Nonparametric method

Protocol fingerprints are a set of byte subsequences within packet payload that can distinguish individual application protocols. They play an important role for deep packet analysis in traffic normalization and network management. In this paper, we propose ProPrint, a network trace-based protocol fingerprint inference system. In ProPrint, we first build a protocol language model based on a modified nonparametric Bayesian statistical model. Second, we use the corresponding protocol language model to identify field boundaries in packet payload, such that we can segment each payload into a set of protocol feature words according to the hidden structure information. Third, we propose a ranking algorithm that selects true protocol fingerprints from the candidate protocol feature words. In evaluations, we measure ProPrint on real-world network traces, and also compare ProPrint to existing state-of-the-art solutions, ProWord and Securitas. The experimental results show that ProPrint performs better than ProWord and Securitas on f-measure for online application classification.

• 出版日期2017-12-1
• 单位中国科学院信息工程研究所; 中国科学院大学