A positional keyword-based approach to inferring fine-grained message formats
| Autor: | Steve Versteeg, M.D. Arafat Hossain, Jiaojiao Jiang, Jean-Guy Schneider, Jun Han |
|---|---|
| Rok vydání: | 2020 |
| Předmět: |
Information retrieval
Computer Networks and Communications Computer science Network security business.industry SOAP computer.internet_protocol Message format 020206 networking & telecommunications 02 engineering and technology Service virtualization Hierarchical clustering Hardware and Architecture Lightweight Directory Access Protocol 0202 electrical engineering electronic engineering information engineering 020201 artificial intelligence & image processing Cluster analysis business computer Software |
| Zdroj: | Future Generation Computer Systems. 102:369-381 |
| ISSN: | 0167-739X |
| DOI: | 10.1016/j.future.2019.08.011 |
| Popis: | Message format extraction, the process of revealing the message syntax without access to the protocol specification, is important for a variety of applications such as service virtualization and network security. In this paper, we propose P-token, which mines fine-grained message formats from network traces. The novelty of our approach is twofold: a ‘positional keyword’ identification technique and a two-level hierarchical clustering strategy. Positional keywords are based on the insight that keywords or reserved words usually occur at relatively fixed positions in the messages. By associating positions as meta-information with keywords, we can more accurately distinguish keywords from message payload data. After identification, the positional keywords are used as features to cluster the messages using density peaks clustering. We then perform another level of clustering to refine the clusters with low homogeneity. Finally, the message format of each cluster is extracted based on the observed ordering of keywords. P-token improves on the current state-of-the-art techniques by successfully addressing two challenges that commonly afflict existing keyword based format extraction methods: message keyword mis-identification and message format over-generalization. We have conducted experiments on services and applications using various protocols, including SOAP, LDAP, IMS and a RESTful service. Our experimental results show that P-token outperforms existing methods in extracting message formats. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|
Full Text from ScienceDirect