Patent Document ID: 8646075
Application ID: 13456225
Patent Flag: 1

Claim One:
1. An analysis system for unknown application layer protocols, characterized in that: the analysis system for unknown application layer protocols comprises the following processing modules: a) A module for collecting unknown application layer data used for online identification of various known applications and storing of unidentifiable application layer data into a disk; b) A module for performing cluster analysis on unknown applications used for performing cluster analysis on collected data and treating each resulting cluster as an unknown application; c) A module for performing reversed engineering on unknown application layer protocols used for optimal partitioning of message sequences based on hidden semi-Markov model (HSMM) to obtain protocol keywords, message formats, dialogue rules and status transfer relations of the unknown applications; the analysis system for unknown application layer protocols adopts the following perspective for processing and model building of the unknown application layer data: a sequence formed by messages in two-way transmission during an unknown application layer protocol session process is called an observation sequence, wherein the observation sequence consists of a series of characters O 1 O 2. .. O T , O t represents the t′ th character, T represents the length of the observation sequence, and a sub-sequence of observations or a sub character string started at the t th character and ended at the t′ th character is marked as O t:t′ =O t O t+1. .. O t′ ; each message includes one to more than one field fixed or variable in length each field is formed by a protocol keyword followed by 0 to more than 1 characters; and transition from a field to another field is a first-order Markov process.