Towards automated application signature generation for traffic identification
Towards automated application signature generation for traffic identification
复制标题
DOI：
10.1109/noms.2008.4575130
复制
发表时间：
2008-04
期刊：
影响因子：
--
通讯作者：
Byungchul Park;Young J. Won;Myung-Sup Kim;J. W. Hong
中科院分区：
文献类型：
--
作者：
Byungchul Park;Young J. Won;Myung-Sup Kim;J. W. Hong
传统上，互联网应用程序是通过使用预定义的众所周知的端口来识别的，其准确性值得怀疑。另一种方法，应用层签名映射，涉及可靠签名的穷举搜索，但具有更有前途的准确性。通过先验协议知识，签名生成可以保证高准确性。随着越来越多的应用程序使用专有协议，在避免耗时和手动签名生成过程的同时获得准确签名变得越来越困难。本文提出了一种自动化的方法来生成应用程序级的签名，激光算法，不需要之前的应用程序协议的分析。我们表明，我们的方法是准确和有效的方法，使用前面的应用程序协议分析。
Traditionally, Internet applications have been identified by using predefined well-known ports with questionable accuracy. An alternative approach, application-layer signature mapping, involves the exhaustive search of reliable signatures but with more promising accuracy. With a prior protocol knowledge, the signature generation can guarantee a high accuracy. As more applications use proprietary protocols, it becomes increasingly difficult to obtain an accurate signature while avoiding time-consuming and manual signature generation process. This paper proposes an automated approach for generating application-level signature, the LASER algorithm, that does not need to be preceded by an analysis of application protocols. We show that our approach is as accurate and efficient as the approach that uses preceding application protocol analysis.