Patent Document ID: 8646075
Application ID: 13456225

Base Claim:
1. An analysis system for unknown application layer protocols, characterized in that: the analysis system for unknown application layer protocols comprises the following processing modules: a) A module for collecting unknown application layer data used for online identification of various known applications and storing of unidentifiable application layer data into a disk; b) A module for performing cluster analysis on unknown applications used for performing cluster analysis on collected data and treating each resulting cluster as an unknown application; c) A module for performing reversed engineering on unknown application layer protocols used for optimal partitioning of message sequences based on hidden semi-Markov model (HSMM) to obtain protocol keywords, message formats, dialogue rules and status transfer relations of the unknown applications; the analysis system for unknown application layer protocols adopts the following perspective for processing and model building of the unknown application layer data: a sequence formed by messages in two-way transmission during an unknown application layer protocol session process is called an observation sequence, wherein the observation sequence consists of a series of characters O 1 O 2 . . . O T , O t represents the t′ th character, T represents the length of the observation sequence, and a sub-sequence of observations or a sub character string started at the t th character and ended at the t′ th character is marked as O t:t′ =O t O t+1 . . . O t′ ; each message includes one to more than one field fixed or variable in length each field is formed by a protocol keyword followed by 0 to more than 1 characters; and transition from a field to another field is a first-order Markov process.

---

Claim 2:
2. The analysis system for unknown application layer protocols as in claim 1 , characterized in that, the HSMM is defined as follows: A state sequence corresponding to O t:t′ is S t:t =S t S t+1 . . . S t′ , wherein S k εS, represents the k th state corresponding to observation O k , k=t, t+1, . . . , t′, S t , S={1, 2, . . . , M} is the set of all states and M is the size of the set; a state ending at t′ is represented by S t′] ; a state starting at t is represented by S [t ; S [t:t′ represents a state started at t but not yet ended at t′ meaning S [t =S t+1 = . . . =S t′ ; S t:t′] represents a state already started before/at t and ended at t′ meaning S t =S t+1 = . . . =S t′] ; and S [t:t′] represents a state started at t and ended at t′ with a state length of t′−t+1 characters, meaning S [t =S t+1 = . . . =S t′] ; let a jj be a probability of transition from state i to state j, and ∑ j ⁢ ⁢ a ij = 1 is satisfied whereas a ii =0; initial probability of the state i is defined as π j ; KEY is defined as a set of all output values (i.e., observable keywords) of states, and k j (key) is defined as probability of key being output value (i.e., observed keyword) in the given state j, and ∑ key ⁢ ∈ ⁢ KEY ⁢ ⁢ k j ⁡ ( key ) = 1 is satisfied; when given state j and its output value being keyεKEY, probability of d≧[key] being length of continuation of the sate is I j,key (d), [key] is length of key and ∑ d ⁢ ⁢ l j , key ⁡ ( d ) = 1 is satisfied; and λ={a ii , π i , k i (key), I j , key(d)|i,jεS, keyεKEY, d≧[key ]} represents the set of all the model parameters.