Unsupervised Binary Protocol Clustering Based on Maximum Sequential Patterns

In order to solve the problem that there are a large number of unknown protocols on the network, which affect the network management and network security in varying degrees, an unknown binary protocol identification method is proposed. On the premise that the center cluster of unknown protocols is obtained by the clustering algorithm, the unknown protocols for network traffic are identified by combining one‐class of classification with one‐dimensional CNN classification technology. At first, a class of classification algorithm is used to select the unknown protocols, and then, the labeled protocol data obtained by clustering are used to train the one‐dimensional CNN model, and the classified binary protocol packets are directly used as the input of the one‐dimensional convolution neural network. After the classification of the CNN model, the unknown protocols are finally identified. The experimental results show that the proposed classification and recognition method is better than the traditional CNN and SVM algorithms, and the maximum frequency pooling is better than the traditional pooling method.

In recent years, due to the large number of unknown protocols, it is necessary to study the security of unknown protocols. IFuzzing is a universal method that can be used to study unknown protocols. In unknown protocol fuzzy test, the test object in reality often tend to be in a state of isolation, in most cases only black box testing is used, and black box testing can get feedback information is very little, which makes the black box testing of unknown protocol is often a violent test method, and it is difficult to optimize. In view of the above situation, this paper proposes a method to optimize fuzzy testing by analyzing the message of unknown protocol and combining the concept of path testing to build the message type time series tree (MTTS-Tree). Experiments show that this approach makes black-box testing of unknown protocols more strategic.KeywordsUnknown protocolFuzzy testingBlack box testingPath testing

Unknown protocol identification is widely used in the field of network and information security. Most previous researches focus on known protocol identification and analysis of network layer and above. However, the research on unknown protocol is an essential part for ensuring the safety of information system. In this work, a length identification method of unknown data frame is proposed based on characteristic searching of bit stream of unknown protocol, which can analyzes and researches protocols unknown from physical layer to application layer and determines the length of frame effectively. This method can adapt to the identification of unknown communication protocol and is significant to network and information security.

In view of the special nature of the marine network security, this paper is mainly based on the fuzzy set theory and entropy weight to some aspects of the network security risk assessment, and gives the description of scale, constructs the membership degree matrix of the corresponding evaluation factors, entropy weight coefficient method is used to determine the factor weights to reduce the traditional weight method for subjective deviation, Using system synthesis method, the safety risk value of each element of integration and then decides the grade of Marine network system security risk. The example analysis shows that the method is feasible and effective.

The Traveling Salesman Problem (TSP) is an NP-hard graph search problem. Despite having numerous modifications of the original abstract problem, Time Dependent Traveling Salesman Problem (TD TSP) was one of the most realistic extensions under real traffic conditions. In TD TSP the edges between nodes are assigned higher costs (weights), if they were traveled during the rush hour periods, or crossed the traffic jam regions, such as the city center(s). In this paper we introduce an even more real-life motivated approach, the Intuitionistic Fuzzy Time Dependent Traveling Salesman Problem (IFTD TSP), which is a further extension of the TSP, and also of the classic TD TSP, with the additional notion of using intuitionistic fuzzy sets for the definition of uncertain costs, time, and space of the rush hour—traffic jam region affecting graph sections. In IFTD TSP we use fuzzy memberships and non-memberships sets for estimating the vague costs between nodes in order to quantify the behavior of traffic jam regions, and the rush hour periods. Since intuitionistic fuzzy sets are generalizations of classic fuzzy sets, our approach may be considered an extension and substitution of the original abstract TD TSP problem, even, of the (classic) Fuzzy TD TSP. Lastly, DBMEA (Discrete Bacterial Memetic Evolutionary Algorithm) was applied on the IFTD TSP model, the results of the simulation runs based on some extensions of the benchmarks generated from the original TD TSP data set showed quite good and promising preliminary results.

Protocol reverse analysis is a research hotspot in the field of information confrontation and network security. Inferring the format of unknown binary protocols from network traces is one challenge task in protocol reverse engineering. In this study, a protocol reverse method for binary protocol which combined with hierarchical clustering and probability alignment is proposed. First, the method classifies the frames with same format into one set based on hierarchical clustering. Second, probability alignment algorithm is adopted to align the corresponding fields in protocol frame accurately. Finally, according to the characteristics of the statistical data, the boundary of the adjacent fields in the protocol is determined, and the protocol format is extracted according to the field boundary. The experimental results show that the method can effectively identify the format specification of the binary protocol and the semantic specification of some fields.

Network traffic classification is an enabling technique for network security and management for both traditional networks and emerging networks such as Internet of Things. Due to the decreasing effectiveness of traditional port-based and payload-based methods, lots of research attentions are devoted to an alternative approach based on flow and packet-level traffic characteristics. A variety of statistical classification schemes are proposed in this context, but most of them embody an implicit assumption that all protocols are known in advance and well presented in the training data. This assumption is unrealistic because real-world networks constantly witness emerging traffic patterns and protocols that are previously unknown. In this paper, we revisit the problem by proposing a learning scheme with unknown pattern extraction for statistical protocol identification. The scheme is designed with a more realistic setting, in which we assume that the training data only consists of labeled samples from a limited number of protocols, and the goal is to identify these known patterns out of arbitrary traffic mixture of both known and unknown protocols. Our experiments based on real-world traffic show that the proposed scheme outperforms previous approaches by accurately identifying both known and unknown protocols.

Application-level protocol specifications are helpful for network security management, including intrusion detection and intrusion prevention which rely on monitoring technologies such as deep packet inspection. Moreover, detailed knowledge of protocol specifications is also an effective way of detecting malicious code. However, current methods for obtaining unknown and proprietary protocol message formats (i.e., no publicly available protocol specification), especially binary protocols, highly rely on manual operations, such as reverse engineering which is time-consuming and laborious. In this paper, we propose Biprominer, a tool that can automatically extract binary protocol message formats of an application from its real-world network trace. In addition, we present a transition probability model for a better description of the protocol. The chief feature of Biprominer is that it does not need to have any priori knowledge of protocol formats, because Biprominer is based on the statistical nature of the protocol format. We evaluate the efficacy of Biprominer over three binary protocols, with an average precision more than 99% and a recall better than 96.7%.

An improved fuzzy logic controller using genetic algorithmic techniques for building management systems

Protocol's abnormal behavior analysis is an important task in protocol reverse analysis. Traditional protocol reverse analysis focus on the protocol message format, but protocol behavior especially the abnormal behavior is rare studied. In this paper, protocol behavior is represented by the labeled behavior instruction sequences. Similar behavior instruction sequences mean the similar protocol behavior. Using our developed virtual analysis platform HiddenDisc, we can capture a variety of known or unknown protocols' behavior instruction sequences. All kinds of executed or unexecuted instruction sequences can automatic clustering by our designed instruction clustering algorithm. Thereby we can distinguish and mine the unknown protocols' potential abnormal behavior. The mined potential abnormal behavior instruction sequences are executed, monitored and analyzed on HiddenDisc to determine whether it is an abnormal behavior and what is the behavior's nature. Using the instruction clustering algorithm, we have analyzed 1297 protocol samples, mined 193 potential abnormal instruction sequences, and determined 187 malicious abnormal behaviors by regression testing. Experimental results show that our proposed instruction clustering algorithm has high efficiency and accuracy, can mine unknown protocols' abnormal behaviors effectively, and enhance the initiative defense capability of network security.

Unsupervised field segmentation of unknown protocol messages

Protocol message format extraction is a principal process of automatic network protocol reverse engineering when target protocol specifications are not available. However, binary protocol reverse engineering has been a new challenge in recent years for approaches that traditionally have dealt with text‐based protocols rather than binary protocols. In this study, the authors propose a novel approach called PRE‐Bin that automatically extracts binary‐type fields of binary protocols based on fine‐grained bits. First, a silhouette coefficient is introduced into the hierarchical clustering to confirm the optimal clustering number of binary frames. Second, a modified multiple sequence alignment algorithm, in which the matching process and back‐tracing rules are redesigned, is also proposed to analyse binary field features. Finally, a Bayes decision model is invoked to describe field features and determine bit‐oriented field boundaries. The maximum a posteriori criterion is leveraged to complete an optimal protocol format estimation of binary field boundaries. The authors implemented a prototype system of PRE‐Bin to infer the specification of binary protocols from actual traffic traces. Experimental results indicate that PRE‐Bin effectively extracts binary fields and outperforms the existing algorithms.

The fuzzy set membership problem using the hierarchy decision method

Several type-1 fuzzy membership function (T1 FMF) generation methods have been proposed to model the uncertainty of pattern data. However, if we cannot obtain satisfactory results using type-1 fuzzy sets, employment of type-2 fuzzy sets (T2 FSs) for managing uncertainty may allow us to obtain desirable results. In this paper, a general T2 FMF design method and its application to back propagation (BP) neural networks is proposed. The general T2 FMF is designed using data histograms and then type-1 fuzzy membership values which are extracted from the centroid of the T2 FMF are used as inputs to the BP neural network. Applying our proposed membership assignment to the BP neural networks shows improvement of the classification performance since the uncertainty of pattern data are desirably controlled by the T2 fuzzy memberships. Experimental results for several data sets are given. ?? 2011 IEEE.

A new scheme to obtain optimal fuzzy subsets and rules is proposed. The method is derived from the use of genetic algorithms, where the genes of the chromosome are classified into two different types. These genes can be arranged in a hierarchical form, where one type of gene controls the other. The effectiveness of this genetic formulation enables the fuzzy subsets and rules to be optimally reduced and, yet, the system performance is well maintained. In this paper, the details of formulation of the genetic structure are given. The required procedures for coding the fuzzy membership function and rules into the chromosome are also described. To justify this approach to fuzzy logic design, the proposed scheme is applied to control a constant water pressure pumping system. The obtained results, as well as the associated final fuzzy subsets, are included in this paper. Because of its simplicity, the method could lead to a potentially low-cost fuzzy logic implementation.