Abstract:

In the process of bit-stream unknown protocol identification, how to separate multi-protocol data frames into single protocol data frames is a challenging issue. To solve this problem, we propose an improved algorithm based on the idea of traditional AGNES algorithm. Combining the features of bit-stream data frames, this algorithm can define the similarity between data frames and the similarity between clusters by two different ways. We perform clustering and extract clusters that meet the requirements of the class cluster simultaneously. Protocol data frames can be clustered quickly and effectively without inputting the number of clusters. And a similarity evaluation is included in the results of class clusters. Tests on the data set published by the Lincoln Laboratory show that the algorithm has a higher accuracy rate for clustering protocol data frames.

Key words: unknown protocol, protocol identification, hierarchical clustering algorithm, clustering