计算机工程与应用 ›› 2020, Vol. 56 ›› Issue (16): 199-203.DOI: 10.3778/j.issn.1002-8331.1907-0133

• 图形图像处理 • 上一篇    下一篇

基于Simhash的协议数据高频相似序列提取算法

黄学波,徐正国,燕继坤   

  1. 盲信号处理国家重点实验室,成都 610041
  • 出版日期:2020-08-15 发布日期:2020-08-11

High-Frequency Similar Sequence Extraction Algorithm of Protocol Data Based on Simhash

HUANG Xuebo, XU Zhengguo, YAN Jikun   

  1. State Key Laboratory of Blind Signals Processing, Chengdu 610041, China
  • Online:2020-08-15 Published:2020-08-11

摘要:

在网络协议特征提取问题中,已有的基于频率统计和序列比对等算法在时间效率和准确率上有一定缺陷,因此提出了一种基于Simhash的高频相似序列提取方法。针对传统的Simhash算法一般用于文本处理领域的问题,根据二进制序列的特点将协议数据进行“分词”处理,并采用了减少哈希结果长度、降低比较次数等方法进一步提高算法效率,最终使Simhash适合于高频相似序列提取问题。实验结果表明,该算法的平均覆盖率达到74.28%,并且在此准确率的条件下时间效率较高。

关键词: 协议分析, 二进制序列, Simhash, 高频相似序列

Abstract:

In the feature extraction problem of network protocol, the existing algorithms based on frequency statistics and sequence alignment have some shortcomings in time efficiency and accuracy, so a high-frequency similar sequence extraction algorithm based on Simhash is proposed. The traditional Simhash algorithm is generally used in the field of text processing, the protocol data are processed by word segmentation according to the characteristics of binary sequences, and methods such as reducing the length of hash results and the number of comparisons are adopted to further improve the algorithm efficiency. Finally, Simhash is suitable for the extraction of high-frequency similar sequences. Experimental results show that the average coverage rate of the algorithm is 74.28%, and the time efficiency is higher under the condition of such accuracy.

Key words: protocol analysis, binary sequence, Simhash, high-frequency similar sequence