Method and apparatus for identifying application protocol
View Patent ↗In an embodiment, the method of identifying an application protocol includes classifying a data packet to be detected into an individual traffic flow, searching for keywords in a valid payload of the traffic flow based upon a keyword database of identifiable application protocols, and determining a keyword weight vector of the traffic flow. The weight of a keyword is related to a location of the keyword in a valid payload of a traffic flow. Similarities between the keyword weight vector of the traffic flow and feature keyword weight vectors of the identifiable application protocols are determined; and an application protocol corresponding to a feature keyword weight vector with the highest similarity to the keyword weight vector of the traffic flow as the application protocol of the traffic flow is deteremined if a condition is satisfied.
1. A method of identifying an application protocol, the method comprising:
A. classifying a data packet to be detected into an individual traffic flow;
B. searching for keywords in a valid payload of the traffic flow based upon a keyword database of identifiable application protocols, and determining a keyword weight vector of the traffic flow, wherein a weight of a keyword is related to a location of the keyword in a valid payload of a traffic flow;
C. determining similarities between the keyword weight vector of the traffic flow and feature keyword weight vectors of the identifiable application protocols; and
D. determining an application protocol corresponding to a feature keyword weight vector with the highest similarity to the keyword weight vector of the traffic flow as the application protocol of the traffic flow if a predetermined condition is satisfied.
2. The method according to claim 1 , wherein a keyword, which appears earlier in a valid payload of a traffic flow for a first time, has a larger weight in the step B.
3. The method according to claim 2 , wherein a weight of an i th keyword in a key weight vector of a traffic flow f d is represented as ω id =itp id ×idf i ;
wherein itp id =1/o id , o id represents a location where the i th keyword appears in the traffic flow f d for a first time; and
wherein
idf
i
=
log
|
F
|
|
{
f
:
k
i
∈
f
}
|
,
|F| represents a total amount of traffic flows, and |{f:k i εf}| represents an amount of traffic flows including the i th keyword k i .
4. The method according to claim 1 , wherein before the step A, the method further comprises:
a. searching for keywords in valid payloads of a plurality of training traffic flows based upon the keyword database of the identifiable application protocols, and determining keyword weight vectors of the plurality of training traffic flows; and
b. determining a feature keyword weight vector corresponding to each of the identifiable application protocols according to the keyword weight vectors of the plurality of training traffic flows.
5. The method according to claim 4 , wherein the keyword weight vectors of the plurality of training traffic flows are determined in the step a using the same algorithm as in the step B; and
wherein a weight of an ith keyword in a key weight vector of a j th traffic flow is represented as ω ij =itp ij ×idf i ;
wherein itp ij =1/o ij , o ij , represents a location where the i th keyword appears in the J th traffic flow for a first time; and
wherein
idf
i
=
log
|
F
|
|
{
f
:
k
i
∈
f
}
|
,
|F| represents a total amount of the traffic flows, and |{f :k i εf }| represents an amount of the traffic flows including the i th keyword k i .
6. The method according to claim 1 , wherein the data packet to be detected is classified according to a 5-tuple of the data packet in the step A, and the 5-tuple includes a source address, a destination address, a source port number, a destination port number and a transport protocol type; and the similarity in the step C includes a cosine similarity.
7. The method according to claim 1 , wherein the predetermined condition includes the highest similarity being above a predetermined value.
8. An apparatus for identifying an application protocol, the apparatus comprising:
a first device, in network equipment controlled by a processor, configured to classify a data packet to be detected into an individual traffic flow;
a second device, in the network equipment controlled by the processor, configured to search for keywords in a valid payload of the traffic flow based upon a keyword database of identifiable application protocols, and to determine a keyword weight vector of the traffic flow, wherein a weight of a keyword is related to a location of the keyword in a valid payload of a traffic flow;
a third device, in the network equipment controlled by the processor, configured to determine similarities between the keyword weight vector of the traffic flow and feature keyword weight vectors of the identifiable application protocols; and
a fourth device, in the network equipment controlled by the processor, configured to determine an application protocol corresponding to a feature keyword
weight vector with highest similarity to the keyword weight vector of the traffic flow as the application protocol of the traffic flow if a predetermined condition is satisfied.
9. The protocol identifying apparatus according to claim 8 , wherein a keyword, which appears earlier in a valid payload of a traffic flow for a first time, has a larger weight in the second device.
10. The protocol identifying apparatus according to claim 9 , wherein a weight of an i th keyword in a key weight vector of a traffic flow f d is represented as ω id =itp id ×idf i ;
wherein itp id =1/o id , o id represents a location where the i th keyword appears in the traffic flow f d for a first time; and
wherein
idf
i
=
log
|
F
|
|
{
f
:
k
i
∈
f
}
|
,
|F| represents a total amount of traffic flows, and |{f:k i εf}| represents an amount of traffic flows including the i th keyword k i .
11. The protocol identifying apparatus according to claim 8 , wherein before the step A, wherein the second device is further configured:
to search for keywords in valid payloads of a plurality of training traffic flows based upon the keyword database of the identifiable application protocols, and to determine keyword weight vectors of the plurality of training traffic flows; and
to determine a feature keyword weight vector corresponding to each of the identifiable application protocols according to the keyword weight vectors of the plurality of training traffic flows.
12. The protocol identifying apparatus according to claim 11 , wherein the second device determines the keyword weight vectors of the plurality of training traffic flows and the traffic flow of the data packet to be detected using the same algorithm; and
wherein a weight of an i th keyword in a key weight vector of a j th traffic flow is represented as ω ij =itp ij ×idf i ;
wherein itp ij =1/o ij , o ij represents a location where the i th keyword appears in the j th traffic flow for a first time; and
wherein
idf
i
=
log
|
F
|
|
{
f
:
k
i
∈
f
}
|
,
|F| represents a total amount of the traffic flows, and |{f:k i εf}| represents an amount of the traffic flows including the i th keyword k i .
13. The protocol identifying apparatus according to claim 8 , wherein the first device classifies the data packet to be detected according to a 5-tuple of the data packet, and the 5-tuple includes a source address, a. destination address, a source port number, a destination port number and a transport protocol type; and the similarity in the third device includes a cosine similarity.
14. The protocol identifying apparatus according to claim 8 , wherein the predetermined condition includes the highest similarity being above a predetermined value.