無線環(huán)境下比特流協(xié)議幀定位與特征分析
發(fā)布時間：2018-07-14 07:57
【摘要】：在現(xiàn)代網(wǎng)絡通信環(huán)境中,隨著無線網(wǎng)絡相關技術的迅速發(fā)展及其廣泛部署,無線網(wǎng)絡通信中安全性需求日益突顯。由于無線網(wǎng)絡傳輸介質(zhì)為無線波,而這種介質(zhì)在本質(zhì)上就是開放的,這使得網(wǎng)絡中傳輸?shù)臄?shù)據(jù)很容易被截獲,同時數(shù)據(jù)竊密者也可以使用未知或非常規(guī)協(xié)議來傳輸數(shù)據(jù)以達到攻擊目的;在網(wǎng)絡對抗方面,監(jiān)聽者在偵查截獲到對方傳輸?shù)奈锢硇盘柡?由于未知協(xié)議及其格式而無法從比特流中準確地切割幀并解析幀格式;同時,無線環(huán)境下的比特流協(xié)議幀定位與特征分析也是對上層未知協(xié)議數(shù)據(jù)識別和分析的重要基礎,然而現(xiàn)有的協(xié)議特征分析技術大多致力于上層協(xié)議格式解析,而由于監(jiān)聽者無法直接獲取對方數(shù)據(jù)的協(xié)議格式,在比特流中進行幀定位和特征分析成為進一步解析上層數(shù)據(jù)的重要基礎,同時也是一個難點問題。本文在對國內(nèi)外幀定位技術和未知協(xié)議特征分析技術進行了分析總結(jié)和對多模式匹配算法、關聯(lián)規(guī)則挖掘算法、聚類算法和序列比對算法等相關算法研究的基礎上,提出了無線網(wǎng)絡環(huán)境下比特流協(xié)議幀定位與特征分析算法,并通過采集真實環(huán)境中數(shù)據(jù)進行了一系列驗證實驗,本文主要完成了以下研究工作:1.針對國內(nèi)外現(xiàn)有的幀定位技術的局限性,本文提出了在沒有先驗知識的情況下通過頻繁串提取和關聯(lián)規(guī)則拼接來識別幀同步碼從而實現(xiàn)幀定位的方法。該方法利用了改進的AC算法來實現(xiàn)對所有長度為m的模式串統(tǒng)計;同時,考慮到算法性能問題,提出了采用關聯(lián)規(guī)則挖掘算法進行頻繁串拼接進而發(fā)現(xiàn)比特流中的同步序列;最后,提出利用計算漢明距離來檢測比特流數(shù)據(jù)中同步碼出現(xiàn)位置以實現(xiàn)幀定位。2.為了在完整切割后的幀集合中進一步分析協(xié)議特征,本文提出了基于聚類算法和改進的序列比對算法的特征分析技術,利用聚類算法將切分后的幀按照協(xié)議格式來進行聚類。同時,本文提出采用改進的多序列比對算法和序列相應位的相似度閾值提取各個未知協(xié)議幀中相應的協(xié)議特征序列來標識不同的協(xié)議格式。3.為了驗證本文提出算法的有效性和準確性,采集了真實環(huán)境下的無線網(wǎng)絡通信數(shù)據(jù)來進行了驗證實驗,提出了篩選準確率,數(shù)據(jù)識別率和誤識別率等指標,對實驗結(jié)果進行評價。并采用四種典型的聚類算法對不同幀格式數(shù)據(jù)進行聚類,并對其性能從時間消耗、資源消耗和準確率等方面進行了比較,總結(jié)了四種算法的優(yōu)點和局限性以及在幀聚類方法中不同適用場景。
[Abstract]:In the modern network communication environment, with the rapid development of wireless network related technology and its extensive deployment, the security requirements in wireless network communication become increasingly prominent. Because the wireless network transmission medium is wireless wave, and this medium is essentially open, which makes it easy to intercept the data transmitted in the network. At the same time, the data stealer can also use unknown or unconventional protocols to transmit data for the purpose of attack. In network countermeasures, the listener detects the physical signals transmitted by the other party. Because of the unknown protocol and its format, the frame can not be accurately cut and analyzed from the bitstream. At the same time, the frame location and feature analysis of the bitstream protocol in wireless environment is also an important basis for the identification and analysis of the upper layer unknown protocol data. However, most of the existing protocol feature analysis techniques are devoted to the upper layer protocol format analysis, but because the listener can not directly obtain the protocol format of the other party's data, Frame location and feature analysis in bitstream is an important basis for further analysis of upper layer data, and it is also a difficult problem. Based on the analysis and summary of frame localization technology and unknown protocol feature analysis technology at home and abroad, and the research of multi-pattern matching algorithm, association rule mining algorithm, clustering algorithm and sequence alignment algorithm, etc. In this paper, a frame localization and feature analysis algorithm for bitstream protocol in wireless network environment is proposed, and a series of verification experiments are carried out by collecting real data. In this paper, the following research work is accomplished: 1. In view of the limitations of existing frame localization techniques at home and abroad, this paper proposes a method to identify frame synchronization codes by frequent string extraction and association rule stitching without prior knowledge. In this method, the improved AC algorithm is used to realize the statistics of all pattern strings whose length is m, meanwhile, considering the performance of the algorithm, an association rule mining algorithm is proposed for frequent string splicing to discover the synchronous sequences in the bitstream. Finally, it is proposed to use the hamming distance to detect the position of the synchronization code in the bitstream data to realize the frame location. In order to further analyze the protocol features in the complete cut frame set, this paper proposes a feature analysis technique based on clustering algorithm and an improved sequence alignment algorithm, which uses the clustering algorithm to cluster the segmented frames according to the protocol format. At the same time, an improved multi-sequence alignment algorithm and the similarity threshold of sequence bits are proposed to extract the corresponding protocol feature sequences from each unknown protocol frame to identify different protocol formats. In order to verify the validity and accuracy of the proposed algorithm, the wireless network communication data in real environment are collected to carry out the verification experiment, and the selection accuracy, data recognition rate and error recognition rate are proposed. The experimental results were evaluated. Four typical clustering algorithms are used to cluster data in different frame formats, and their performance is compared in terms of time consumption, resource consumption and accuracy. The advantages and limitations of the four algorithms and their application in frame clustering are summarized.
【學位授予單位】：電子科技大學
【學位級別】：碩士
【學位授予年份】：2014
【分類號】：TN92
本文編號：2120986
[Abstract]:In the modern network communication environment, with the rapid development of wireless network related technology and its extensive deployment, the security requirements in wireless network communication become increasingly prominent. Because the wireless network transmission medium is wireless wave, and this medium is essentially open, which makes it easy to intercept the data transmitted in the network. At the same time, the data stealer can also use unknown or unconventional protocols to transmit data for the purpose of attack. In network countermeasures, the listener detects the physical signals transmitted by the other party. Because of the unknown protocol and its format, the frame can not be accurately cut and analyzed from the bitstream. At the same time, the frame location and feature analysis of the bitstream protocol in wireless environment is also an important basis for the identification and analysis of the upper layer unknown protocol data. However, most of the existing protocol feature analysis techniques are devoted to the upper layer protocol format analysis, but because the listener can not directly obtain the protocol format of the other party's data, Frame location and feature analysis in bitstream is an important basis for further analysis of upper layer data, and it is also a difficult problem. Based on the analysis and summary of frame localization technology and unknown protocol feature analysis technology at home and abroad, and the research of multi-pattern matching algorithm, association rule mining algorithm, clustering algorithm and sequence alignment algorithm, etc. In this paper, a frame localization and feature analysis algorithm for bitstream protocol in wireless network environment is proposed, and a series of verification experiments are carried out by collecting real data. In this paper, the following research work is accomplished: 1. In view of the limitations of existing frame localization techniques at home and abroad, this paper proposes a method to identify frame synchronization codes by frequent string extraction and association rule stitching without prior knowledge. In this method, the improved AC algorithm is used to realize the statistics of all pattern strings whose length is m, meanwhile, considering the performance of the algorithm, an association rule mining algorithm is proposed for frequent string splicing to discover the synchronous sequences in the bitstream. Finally, it is proposed to use the hamming distance to detect the position of the synchronization code in the bitstream data to realize the frame location. In order to further analyze the protocol features in the complete cut frame set, this paper proposes a feature analysis technique based on clustering algorithm and an improved sequence alignment algorithm, which uses the clustering algorithm to cluster the segmented frames according to the protocol format. At the same time, an improved multi-sequence alignment algorithm and the similarity threshold of sequence bits are proposed to extract the corresponding protocol feature sequences from each unknown protocol frame to identify different protocol formats. In order to verify the validity and accuracy of the proposed algorithm, the wireless network communication data in real environment are collected to carry out the verification experiment, and the selection accuracy, data recognition rate and error recognition rate are proposed. The experimental results were evaluated. Four typical clustering algorithms are used to cluster data in different frame formats, and their performance is compared in terms of time consumption, resource consumption and accuracy. The advantages and limitations of the four algorithms and their application in frame clustering are summarized.
【學位授予單位】：電子科技大學
【學位級別】：碩士
【學位授予年份】：2014
【分類號】：TN92
【參考文獻】
相關期刊論文 前5條
1 萬國根;秦志光;;改進的AC-BM字符串匹配算法[J];電子科技大學學報;2006年04期
2 李偉明;張愛芳;劉建財;李之棠;;網(wǎng)絡協(xié)議的自動化模糊測試漏洞挖掘方法[J];計算機學報;2011年02期
3 張紅云,劉向東,段曉東,苗奪謙,馬垣;數(shù)據(jù)挖掘中聚類算法比較研究[J];計算機應用與軟件;2003年02期
4 張一嘉;;局域網(wǎng)鏈路層數(shù)據(jù)幀識別算法的設計與實現(xiàn)[J];通信對抗;2007年04期
5 孫超;;等幀長信號幀長度估計技術研究[J];無線電工程;2013年02期
相關碩士學位論文 前1條
1 李樹政;基于Snort系統(tǒng)快速模式匹配算法的研究[D];吉林大學;2009年
，本文編號：2120986
本文鏈接：http://sikaile.net/kejilunwen/wltx/2120986.html
最近更新
教材專著
