关键词: 协议识别, 层次聚类, 网络流量, 网络管理

Abstract:

Recognition of application layer protocols is to extract key features that can identify application layer protocols from network traffic, and divide the application layer protocol data according to the key features. Aiming to improve the recognition rate of unknown application layer protocols, an application layer protocol recognition method based on adaptive clustering is proposed in the paper. The method takes advantage of the traditional AGNES hierarchical clustering algorithm, and analyzes payload characteristics of the application layer protocols. The application layer protocols are clustered based on the payload similarity. Meanwhile, the method improves the clustering efficiency by dividing the similarity calculation in clustering algorithm into two parts： similarity calculation between application layer protocol data and similarity calculation between clusters, and avoids redundant calculation. Experimental results show that the algorithm can cluster network traffic of unknown application layer protocols efficiently and accurately.

Key words: protocol recognition, hierarchical clustering, network traffic, network management