Abstract: Towards the protocol classification problem in unencrypted network environment, a feature construction method with antinoise capability is studied. Using the local sensitive hashing algorithm, the fragments of high frequency in protocol data are extracted, which can reflect the inherent characteristics of the protocol data. The inherent characteristics are less susceptible to the network transmission than the external features based on the protocol traffic statistics. The experimental results show that the accuracy of protocol classification can achieve over 80% by taking advantage of the proposed feature, while the classification performance of this feature is not influenced much in the noisy environment.

Key words: protocol classification, antinoise, protocol feature, locality sensitive hashing, multi-classification, network protocol

摘要： 针对未加密条件下的协议分类问题，研究了具有抗噪能力的协议特征构造方法。利用局部敏感哈希算法，筛选出协议样本数据中高频相似的数据片段，在此基础上提出了一种能够反映协议数据取值分布固有属性的协议特征。相比于基于协议流量统计测量的外部特征，协议数据内容的内在特征不易受到网络传输环境的干扰。采用多种典型分类器对该特征的分类性能进行实验验证，结果表明协议分类的准确率大多能达到80%以上，在有噪声干扰的仿真测试条件下，该特征表现出较好的分类抗噪性能。

关键词: 协议分类, 抗噪, 协议特征, 局部敏感哈希, 多分类, 网络协议