Unknown Binary Protocol Recognition Algorithm Based on One Class of Classification and One‐Dimensional CNN

With the rapid development of the Internet, a large number of private protocols emerge on the network. However, some of them are constructed by attackers to avoid being analyzed, posing a threat to computer network security. The blockchain uses the P2P protocol to implement various functions across the network. Furthermore, the P2P protocol format of blockchain may differ from the standard format specification, which leads to sniffing tools such as Wireshark and Fiddler not being able to recognize them. Therefore, the ability to distinguish different types of unknown network protocols is vital for network security. In this paper, we propose an unsupervised clustering algorithm based on maximum frequent sequences for binary protocols, which can distinguish various unknown protocols to provide support for analyzing unknown protocol formats. We mine the maximum frequent sequences of protocol message sets in bytes. And we calculate the fuzzy membership of the protocol message to each maximum frequent sequence, which is based on fuzzy set theory. Then we construct the fuzzy membership vector for each protocol message. Finally, we adopt K-means++ to split different types of protocol messages into several clusters and evaluate the performance by calculating homogeneity, integrity, and Fowlkes and Mallows Index (FMI). Besides, the clustering algorithms based on Needleman–Wunsch and the fixed-length prefix are compared with the algorithm presented in this paper. Compared with these traditional clustering methods, we demonstrate a certain improvement in the clustering performance of our work.

As road traffic sign recognition is a crucial component for automatic driver assistance systems, it is a key problem in computer vision as well. Therefore, in this paper, we study on the problem of road traffic sign recognition utilising the computer vision technology. The main innovation of this paper is to propose an improved convolutional neural network, and then use it to tackle the road traffic sign recognition problem. Convolutional neural network can learn features from training data set, and a convolutional network contains alternating layers of convolution and pooling. Particularly, RGB traffic images are transformed to grey scale images, and then grey scale images are input to the improved convolutional neural network. Furthermore, the fixed layers are utilised to discover region of interests, and the learnable layers are used to extract features. In general, output information of the proposed two learnable layers are input to the classifier separately, and parameters of learnable layers and the classifier are trained at the same time. Finally, GTSDB data set is chosen to make performance evaluation, among which 600 images and 300 images are regarded as training and testing data set respectively. Experimental results demonstrate that the improved CNN-based traffic sign recognition performs better than the traditional CNN.

Unknown protocol identification is widely used in the field of network and information security. Most previous researches focus on known protocol identification and analysis of network layer and above. However, the research on unknown protocol is an essential part for ensuring the safety of information system. In this work, a length identification method of unknown data frame is proposed based on characteristic searching of bit stream of unknown protocol, which can analyzes and researches protocols unknown from physical layer to application layer and determines the length of frame effectively. This method can adapt to the identification of unknown communication protocol and is significant to network and information security.

Protocol Reverse Engineering (PRE) is of great significance to the research of cyber security and it is helpful to understand protocol specifications. There has been many researches on PRE but most of them need additional manual analysis, which is not available for private and unknown protocols. We propose a protocol state analysis and annotation method, which extracts the feature information of binary-based protocol data through an auto-encoder model. Moreover, density-based clustering algorithm is only used to distinguish protocol types in existing studies, we propose an improved algorithm and apply it to protocol state analysis. Finally, we apply alignment algorithm to get state information and do annotation. We run simulation to verify the effectiveness of proposed method and prove its feasibility in private and unknown protocols. The results of clustering algorithms are compared to show the improvement. Then the application of proposed method is summarized based on the simulation results, which provides a novel idea for the protocol analysis.

Network traffic classification is an enabling technique for network security and management for both traditional networks and emerging networks such as Internet of Things. Due to the decreasing effectiveness of traditional port-based and payload-based methods, lots of research attentions are devoted to an alternative approach based on flow and packet-level traffic characteristics. A variety of statistical classification schemes are proposed in this context, but most of them embody an implicit assumption that all protocols are known in advance and well presented in the training data. This assumption is unrealistic because real-world networks constantly witness emerging traffic patterns and protocols that are previously unknown. In this paper, we revisit the problem by proposing a learning scheme with unknown pattern extraction for statistical protocol identification. The scheme is designed with a more realistic setting, in which we assume that the training data only consists of labeled samples from a limited number of protocols, and the goal is to identify these known patterns out of arbitrary traffic mixture of both known and unknown protocols. Our experiments based on real-world traffic show that the proposed scheme outperforms previous approaches by accurately identifying both known and unknown protocols.

This paper aims to introduce a novel approach that includes three steps, namely Energy efficient clustering, Disease diagnosis, and an Alert system. Initially, energy-efficient clustering of nodes was conducted, and to render the clustering more optimal, its centroid was optimally selected by a new hybrid algorithm. In addition, this cluster formation was conducted based on constraints such as distance and energy. Further, the disease diagnosis in IoT was performed under two phases namely, “feature extraction and classification”. During feature extraction, the statistical and higher-order features were extracted. These extracted features were then classified via Optimized Deep Convolutional Neural Network (DCNN). To make the classification more precise, the weights of the DCNN were optimally tuned by a new hybrid algorithm referred to as Hybrid Elephant and Moth Flame with Adaptive Learning (HEM-AL). Finally, an alert system was enabled via proposed severity level estimation, which determined the severity of the disease, suggesting patients to visit the hospital. Lastly, the supremacy of the developed approach was examined via evaluation over the other extant techniques. Accordingly, the proposed model attained an accuracy of 0.99 for test case 1, and was 7.41%, 17.34%, and 13.41% better than traditional NN, CNN, and DCNN models.

ABSTRACTWith the development of information technology, malicious software attack methods are becoming increasingly sophisticated, posing a serious threat to network security. Aiming at the problems of existing malware detection technologies, such as low detection rate, high false alarm rate, and poor real‐time performance, this paper proposes a malware detection and defense algorithm based on a hybrid convolutional graph neural network. This algorithm combines the advantages of CNN and GNN to effectively identify malicious behavior by extracting deep‐seated malware features. The experimental results show our algorithm has high accuracy and real‐time performance in malware detection. We employed publicly available malware datasets during the experiment for training and testing. After comparative experiments, the detection rate reaches 95.2%, which is 8.6% higher than the CNN algorithm and 5.3% higher than that of the GNN algorithm. In terms of false alarm rate, the algorithm in this paper is only 1.2%, far lower than the traditional CNN algorithm's 5.8% and the GNN algorithm's 3.5%. At the same time, our algorithm also shows excellent performance in real‐time, and the average detection time is only 0.12 s, which is 20% lower than the traditional algorithm. In addition, to verify the defense capability of the algorithm, we simulate various malware attack scenarios in our experiments. The results show that our algorithm can effectively identify and defend against 90.6% of malware attacks, which strongly supports network security protection.

Protocol's abnormal behavior analysis is an important task in protocol reverse analysis. Traditional protocol reverse analysis focus on the protocol message format, but protocol behavior especially the abnormal behavior is rare studied. In this paper, protocol behavior is represented by the labeled behavior instruction sequences. Similar behavior instruction sequences mean the similar protocol behavior. Using our developed virtual analysis platform HiddenDisc, we can capture a variety of known or unknown protocols' behavior instruction sequences. All kinds of executed or unexecuted instruction sequences can automatic clustering by our designed instruction clustering algorithm. Thereby we can distinguish and mine the unknown protocols' potential abnormal behavior. The mined potential abnormal behavior instruction sequences are executed, monitored and analyzed on HiddenDisc to determine whether it is an abnormal behavior and what is the behavior's nature. Using the instruction clustering algorithm, we have analyzed 1297 protocol samples, mined 193 potential abnormal instruction sequences, and determined 187 malicious abnormal behaviors by regression testing. Experimental results show that our proposed instruction clustering algorithm has high efficiency and accuracy, can mine unknown protocols' abnormal behaviors effectively, and enhance the initiative defense capability of network security.

Aiming at the problem of objects in image recognition rectangle, but objects which are input into convolutional neural networks square, the object recognition model was put forward which was based on BING method to realize object estimate, used vectorization of convolutional neural networks to realize input square image in convolutional networks, therefore, built joint convolution neural networks, which achieve multiple size image input. Verified by experiments, the accuracy of multi-object image recognition was improved by 6.70% compared with single vectorization of convolutional neural networks. Therefore, image recognition method of joint convolutional neural networks can enhance the accuracy in image recognition, especially for target in rectangular shape.

In distribution automation systems, detecting terminal abnormal behaviors is crucial for stability and reliability. Traditional methods struggle with insufficient feature extraction and weak generalization when handling multi-modal data. Thus, an anomaly detection method based on self-attention convolutional neural network (SA-CNN) is proposed, integrating the strengths of self-attention mechanisms and convolutional networks to enhance detection capabilities. Experiments on the IEEE PHM dataset demonstrate superiority over traditional CNN and ARIMA algorithms, achieving accuracy, recall, and F1 scores of 0.928, 0.936, and 0.932, respectively. Future work aims to improve model efficiency and performance.

SummaryWith the improvement of informatization and the development of computer technology, identity recognition with fingerprint has been the growing trend, but the stained fingerprint will make recognition difficult. To solve the above problem, this paper briefly introduced the traditional point matching fingerprint recognition algorithm and the damaged fingerprint recognition method based on the convolution neural network (CNN). Then in MATLAB software, the damaged fingerprint recognition method based on CNN was simulated and compared with the traditional point matching recognition method and traditional CNN recognition method. The results showed that the improved CNN recognition method iterated fewer times and achieved smaller training error during the training; the improved CNN method had lower false recognition rate and rejection rate in identifying the unknown fingerprint; the traditional point matching method spent the most time in identifying the unknown fingerprint, followed by the traditional CNN method and the improved CNN recognition method. This study used CNN for fingerprint recognition and improved CNN to improve its recognition accuracy for the damaged fingerprint. The improved CNN can effectively enhance the recognition accuracy of the damaged fingerprint, which provides a useful reference for the improvement of the accuracy and applicability of the fingerprint recognition system.

The potential of automated question generation is role play in the multi-fields and multi-applications such as question and answering systems, examination systems, and information retrieval. Before learning the question generated, one should understand how to classify questions. This research aims to generate possible questions considering the possible question categories from question classification based on Natural Language Processing. In this research, we compared the results on Logistic Regression, Support Vector Machine, and Multinomial Naï ve Bayes, which were traditional classification models. The deep learning techniques were Convolutional Neural Networks, Bidirectional Long Short-Term Memory, combined CNN and BiLSTM models, and BERT models. The experimental results show that the preprocessing phase using Natural Language Processing could enhance question classification. The classification of the sentence to question classification attained an average micro $F_{1} -$ score of 91.40% when applied BERT model by pre-trained WangchanBERTa on simple sentences. In contrast, the satisfying score with an average micro $F_{1} -$ score of 82.07% (from 80.37% on original input) when applied to add all POS tags unigram + bigram TF-IDF by using the SVM model. The experimental results when the CNN model with GloVe on adding focusing POS tags is a satisfactory score with an average micro $F_{1} -$ score of 79.79%.

Voltage is one of the measurement standard of power quality. The issue of low voltage in distribution network seriously affect the social economic development and people's life. Consequently, it would optimize low voltage investment program, clear direction of low voltage investment and provide decision support for the management of low voltage. Canopy- Kmeans is one of the widely used classical partition clustering algorithm. Support vector machine is a kind of sorting algorithms that could take full advantage of limited learning sample to acquire generalization. Both Canopy-Kmeans and Support Vector Machine have better behavior and precision rate. However, the runtime and RAM would be the bottleneck in the case of large amount of data. The application of data mining algorithm based on big data is particularly important. This paper take advantage of distributed Kmeans and SVM algorithm to realize diagnosis model of cause of low voltage based on big data platform of Hadoop. Experiments have shown that this method has a higher accuracy and reliability compared to traditional Kmeans and SVM algorithm.

Protocol reverse from network traces is widely used in the field of network security. But most of the studies focuse on application-level unknown protocols in Ethernet network system. However, in some special wireless systems, the protocol stack is proprietary. It is in urgent need to do the study on the unknown protocol stack. This paper proposed a new method to delimit frames in the bit stream which generated by signal process. By fully exploiting the characteristics of the wireless protocol data, two levels of frequent items mining are employed and a comprehensive index is applied to recognize the preamble. In the experiment, the method is indicated effective.

Convolutional Neural Network (CNN) is, in general, good at finding principal components of data. However, the characteristic components of the signals could often be obscured by system noise. Therefore, even though the CNN model is well-trained and predict with high accuracy, it may detect only the primary patterns of data which could be formed by system noise. They are, in fact, highly vulnerable to maintenance activities such as reassembly. In other words, CNN models could misdiagnose even with excellent performances. In this study, a novel method that combines the classification using CNN with the data preprocessing is proposed for bearing fault diagnosis. The proposed method is demonstrated by the following steps. First, training data is preprocessed so that the noise and the fault signature of the bearings are separated. Then, CNN models are developed and trained to learn significant features containing information of defects. Lastly, the CNN models are examined and validated whether they learn and extract the meaningful features or not.