数据流应用层载荷特征正则表达式的自动提取.docx

小 型 微 型 计 算 机 系 统Journal of Chinese Computer Systems2014 年 8 月 第 8 期Vol． 35 No． 8 2014数据流应用层载荷特征正则表达式的自动提取武 飞1 ，曾凡平1，2 ，张辉1 ，董齐兴11 ( 中国科学技术大学 计算机科学与技术学院，合肥 230026)2 ( 安徽省计算与通讯软件重点实验室，合肥 230026)E-mail: billzeng@ ustc． edu． cn摘 要: 基于载荷特征的 IP 流分类技术的准确性较高，但是该分类技术的基础是提取出准确的载荷特征． 目前大部分应用的 载荷特征依靠手工逆向分析数据包结构来进行提取． 然而手工分析提取应用产生的数据包是十分耗时的，特别是对于一个未知 的应用． 鉴于此，本文设计并实现了一种把固定位置载荷特征和载荷特征公共子串相结合的载荷特征自动提取算法． 该算法可 以自动提取应用层载荷特征并构造出正则表达式． 除了可以提取出公共特征串之外，还可提取出很多特征提取算法所忽略的固 定位置的单字节特征． 实验结果验证了算法的有效性和准确性．关 键 词: 特征自动提取; 正则表达式; 载荷特征; 数据流分类中图分类号: TP311文献标识码: A文 章 编 号: 1000-1220( 2014) 08-1711-06Automatically Generating Ｒegular Expression of Load Signatures for ApplicationsWU Fei1 ，ZENG Fan-ping1，2 ，ZHANG Hui1 ，DONG Qi-xing11 ( School of Computer Science and Technology ，University of Science and Technology of China，Hefei 230026，China)2 ( Anhui Province Key Lab of Software in Computing and Communication，Hefei 230026，China)Abstract: The classification of IP flow based on the payload signatures is quite accurate，but the basis of the classification method is extracting an accurate payload signature． At present the payload signatures of most applications are generated based on inverse analysis of the packet structures manually． However，analyzing the packets generated by applications manually is time-consuming，especially for an unknown application． Due to this，the paper devises and implements an algorithm for automatic generation of the payload sig- natures，w hich combine the fixed-position payload signatures with the common substrings of the signatures． This algorithm can gener- ate the payload signatures of the application layer and construct the regular expressions of the signatures automatically． In addition to generating the common signatures，this algorithm can also generate the fixed-position one-byte-signature which is usually ignored by many algorithms for generating payload signatures． The experimental results verify the