Length field recognition for unknown network protocol in static trace

Summary form only given. We study on-demand source initiated protocols for mobile wireless networks. In particular, we study the flooding procedure commonly used by these protocols to set up temporary communication paths. The benefit of the flooding technique is its generosity regarding changes in network structure. On the other hand, each time a message is sent, the entire network will be involved to set up the communication path from the source node, to the target node. We propose a new approach, which we call limited broadcasting. It is aimed to reduce the overhead by localizing the search for the target node both in terms of the time the process needs to globally stop after the target has been reached and/or in terms of the region which is affected by the search. It works in unknown networks and does not need any kind of additional information.

With the continuous development of users’ demands and network technology, more and more new network protocols emerge, which poses great challenges to network protocol classification and identification. An artificial intelligence method was used to explore autonomous classification and identification of unknown network protocols in this paper in order to reduce the time and labor cost of network protocol classification and identification. In this paper, firstly, the network traffic was converted into grayscale images, and through transfer learning, the Convolutional Neural Networks (CNN) pre-trained model was used to extract the protocol features, so as to reduce the time and the amount of labeled data needed for the artificial neural network training. Finally, with the improved unsupervised hybrid clustering algorithm based on T-SNE and K-means, the types and number of protocols were autonomously identified and the network traffic was classified simultaneously. In this way, we can identify unknown protocols without prior knowledge and the protocol identification adaptability for big data was also greatly improved. Experimental results show this method has high accuracy and robustness in identifying unknown network protocols.

Network protocol classification plays an important role in modern network security and fine-grained management architectures. The state-of-the-art network protocol classification methods aim to take the advantages of flow statistical features and machine learning techniques. However the classification performance is severely affected by limited supervised information and unknown network protocols. In this paper, a novel semi-supervised learning method is proposed to solve the problem of unknown protocols in the crucial situation of a small labeled training sample set. The proposed method possesses the superior capability of detecting unknown samples generated by unknown protocols with the help of flow correlation information and semi-supervised clustering ensemble learning to boost the classification performance. A theoretical analysis is provided to confirm the effectiveness of the proposed method. Moreover, the comprehensive performance evaluation conducted on real-world network protocols datasets shows that the proposed method is significantly better than the existing methods in the critical network environment.

Unknown network protocol’s stealth attack behavior is becoming a new type of attack, which greatly harms the cyber space security. The stealth behaviors are not easy to be detected by existing security measures. Starting with the implementation of the instructions of the protocol programs, the normal behavior instruction sequences are captured by dynamic binary analysis. The algorithm of instruction clustering and feature distance computation is designed to mine the potential stealth attack behavior instruction sequences. The mined stealth attack behavior instruction sequences (for inline assembly) are loaded into the general executing framework. A virtual protocol behavior analysis platform HiddenDisc has been developed, and the Dynamic analysis is implemented on the platform. Then the protocol execution security evaluation scheme is proposed and implemented. Using the stealth transformation method designed by ourselves, the stealth attack behaviors are transformed. We successfully attacked the virtual target machine by using the transformed stealth attack behaviors, but the stealth behaviors were not captured. The experimental results show that the present method can accurately and efficiently perception mining unknown protocol’s stealth attack behaviors, transform and use of stealth attack behavior can also enhance our information offensive and defensive capabilities.

With the rapid development of the Internet, a large number of private protocols emerge on the network. However, some of them are constructed by attackers to avoid being analyzed, posing a threat to computer network security. The blockchain uses the P2P protocol to implement various functions across the network. Furthermore, the P2P protocol format of blockchain may differ from the standard format specification, which leads to sniffing tools such as Wireshark and Fiddler not being able to recognize them. Therefore, the ability to distinguish different types of unknown network protocols is vital for network security. In this paper, we propose an unsupervised clustering algorithm based on maximum frequent sequences for binary protocols, which can distinguish various unknown protocols to provide support for analyzing unknown protocol formats. We mine the maximum frequent sequences of protocol message sets in bytes. And we calculate the fuzzy membership of the protocol message to each maximum frequent sequence, which is based on fuzzy set theory. Then we construct the fuzzy membership vector for each protocol message. Finally, we adopt K-means++ to split different types of protocol messages into several clusters and evaluate the performance by calculating homogeneity, integrity, and Fowlkes and Mallows Index (FMI). Besides, the clustering algorithms based on Needleman–Wunsch and the fixed-length prefix are compared with the algorithm presented in this paper. Compared with these traditional clustering methods, we demonstrate a certain improvement in the clustering performance of our work.

Research on unknown network protocol reverse engineering is of great significance in many network security applications. Currently most of methods are limited in analyzing plain-text protocols, and a few of method can partly analyze the encryption protocol which is powerless for multiple encryption protocol or sectional encryption protocol. This paper proposes a method of encrypted protocol reverse engineering based on dynamic taint analysis. The method uses Pin to record executed instructions, and then conducts off-line analysis of the data dependencies to build two taint propagation graphs on instruction and function level, then recover the decryption process. The decrypted plaintext can be located due to the decryption process feature. And then, the format of protocol can be parsed. Experiments show that the method can accurately locate the decrypted protocol data of the multiple encryption and sectional encryption protocol, and restore the original format.