Abstract
Previous network feature extraction methods used for network anomaly detection have some problems, such as being unable to extract features from the original network traffic, or that they can only extract coarse-grained features, as well as that they are highly dependent on manual analysis. To solve these problems, this paper proposes a fine-grained and highly practical dynamic application fingerprint extraction method. By putting forward a fine-grained high-utility dynamic fingerprinting (Huf) algorithm to build a Huf-Tree based on the N-gram (every substring of a larger string, of a fixed length n) model, combining it with the network traffic segment-IP address transition (IAT) method to achieve dynamic application fingerprint extraction, and through the utility of fingerprint, the calculation was performed to obtain a more valuable fingerprint, to achieve fine-grained and efficient flow characteristic extraction, and to solve the problem of this method being highly dependent on manual analysis. The experimental results show that the Huf algorithm can realize the dynamic application of fingerprint extraction and solve the existing problems.
Funder
National Key Research and Development Program
Beijing Advanced Innovation Center for Future Blockchain and Privacy Computing
Subject
Fluid Flow and Transfer Processes,Computer Science Applications,Process Chemistry and Technology,General Engineering,Instrumentation,General Materials Science
Reference30 articles.
1. A hybrid intrusion detection system based on ABC-AFS algorithm for misuse and anomaly detection;Comput. Netw.,2018
2. Robust Smartphone App Identification Via Encrypted Network Traffic Analysis;IEEE Trans. Inf. Forensics Secur.,2017
3. Xu, Y., Wang, T., Li, Q., Gong, Q., Chen, Y., and Jiang, Y. (2018, January 3–7). A multi-tab website fingerprinting attack. Proceedings of the 34th Annual Computer Security Applications Conference, San Juan, PR, USA.
4. Dai, S., Tongaonkar, A., Wang, X., Nucci, A., and Song, D. (2013, January 14–19). NetworkProfiler: Towards Automatic Fingerprinting of Android Apps. Proceedings of the INFOCOM, 2013 Proceedings IEEE, Turin, Italy.
5. Khatouni, A.S., and Zincir-Heywood, N. (July, January 29). Integrating Machine Learning with Off-the-Shelf Traffic Flow Features for HTTP/HTTPS Traffic Classification. Proceedings of the 2019 IEEE Symposium on Computers and Communications (ISCC), Barcelona, Spain.