An unknown protocol syntax analysis method based on convolutional neural network. Issue 5 (9th March 2020)

• Record Type: Journal Article
• Authors: Wang, Yichuan; Bai, Binbin; Hei, Xinhong; Zhu, Lei; Ji, Wenjiang
• Other Names: Liu Ximeng guestEditor.; Mu Yi guestEditor.; Ning Jianting guestEditor.; Zhang Qingchen guestEditor.
• Is Part Of: Transactions on emerging telecommunications technologies. Volume 32:Issue 5(2021)
• Page Start: n/a
• Page End: n/a
• Publication Date: 2020-03-09
• Subjects: Telecommunication -- Periodicals; 384.05
• DOI: 10.1002/ett.3922
• Languages: English
• ISSNs: 2161-5748

Abstract

Abstract: In recent years, a large number of botnets and dark networks rely on command and control channels of unknown protocol formats for communication, and with the development of Internet of Things technology, this problem becomes more prominent. The syntax analysis of the unknown protocol is helpful to measure the boundary of Botnet in the environment of Internet of things, so as to protect the network security. Based on the analysis of the characteristics of the current bitstream protocol data format, this article proposes an unknown protocol syntax analysis method based on convolutional neural network (CNN). First, the protocol data are preprocessed, and then the image is transformed. Next, the converted image is input to the convolution layer for convolution. After convolution, the data are flattened. Then the flattened data are put into the fully connected neural network. Finally, the unknown protocol is analyzed and predicted. The experimental results show that compared with the traditional feature extraction combine frequent item algorithm (CFI) and other neural network deep neural networks, CNN is 15% more accurate than CFI in the analysis of unknown protocol syntax, and it can accurately analyze and identify the unknown protocol. Abstract : In this paper, the convolutional neural network, image processing and unknown protocol analysis are combined to propose an unknown protocol parsing method based on convolution neural network. Firstly, the image processing method is used to preprocess the unknown protocol. Then convolution neural network is used to train the data, including convolution, pooling and full connection. Finally, model output and protocol type prediction are carried out.