一种基于改进自编码器的二进制协议聚类方法

A clustering method for binary protocol based on improved auto-encoder

摘要:

针对无先验知识下，混合二进制协议数据帧难以识别分离的问题，提出了一种基于联合高斯混合模型(GMM)和自编码器的聚类方法。对于捕获到的未知二进制数据帧，首先通过栈式自编码器对其进行降维提取特征，并根据相应判别准则获取最佳聚类个数，最后使用改进了代价函数的自编码器对二进制数据帧进一步训练以提高聚类准确率。实验表明，该方法对网络二进制协议数据帧识别的准确率达到94%以上。

Abstract:

To solve the difficulty of identifying the mixed binary protocol data frames without any prior knowledge, a clustering method based on joint Gaussian Mixture Model(GMM) and auto-encoder is proposed. For the captured unknown binary data frames, firstly its features are extracted via dimension reducing by stacked auto-encoder, and then the optimal number of clusters is obtained according to the corresponding criteria, finally the auto-encoder with modified cost function is utilized to train the binary data frames to improve clustering accuracy. The experimental results show that the accuracy of this method for recognizing the network binary protocol data frames is over 94%.