Improved k-means unknown protocol data frame classification method

• Main Authors: REN CHANGQING, LIU ZHIGUO
• Format: Patent
• Language: Chinese; English
• Published: 09.02.2021
• Subjects: CALCULATING; COMPUTING; COUNTING; HANDLING RECORD CARRIERS; PHYSICS; PRESENTATION OF DATA; RECOGNITION OF DATA; RECORD CARRIERS

The invention discloses an improved k-means unknown protocol data frame classification method, which belongs to the technical field of unknown protocol identification, and comprises the following steps of: aligning the lengths of acquired bit stream data frames; taking each byte in the data frame as an attribute, and calculating the information entropy of each attribute to determine the weight ofeach attribute for weighting the Euclidean distance; calculating the density of each data frame, and determining a clustering center based on the maximum and minimum distance criterion in the high-density data set; determining the optimal clustering number k based on the weighted Euclidean distance between the clusters in the cluster, and outputting a clustering result under the optimal k value; data frames of an unknown bit stream form protocol can be quickly and accurately clustered, and the efficiency and the accuracy are high. 本发明公开了一种改进k-means的未知协议数据帧分类方法，属于未知协议识别技术领域，包括：对获取到的比特流数据帧的长度进行对齐处理；将数据帧中每个字节作为一个属性，计算各属性