An Encrypted Field Locating Algorithm for Private Protocol Data Based on Data Reconstruction and Moment Eigenvector
Encrypted network data classification has received considerable attention in the industry and research communities for a long time. However, the emergence of new private applications and encryption protocols has brought more new challenges. The primary task of classification is to determine whether...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2021-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/9366878/ |
| _version_ | 1818736272796024832 |
|---|---|
| author | Qing Li Yonghui Ju Chang Zhao Xintai He |
| author_facet | Qing Li Yonghui Ju Chang Zhao Xintai He |
| author_sort | Qing Li |
| collection | DOAJ |
| description | Encrypted network data classification has received considerable attention in the industry and research communities for a long time. However, the emergence of new private applications and encryption protocols has brought more new challenges. The primary task of classification is to determine whether the sample is encrypted. When the specification of private protocol is unpublished, only the whole sample can be processed, and thus the unencrypted field which coexists with the encrypted field will seriously lower the classification effect. To tackle this problem, an algorithm based on data reconstruction and moment eigenvector is proposed, which can not only estimate the encryption result but also locate the encrypted field in each data sample. In the algorithm, the encryption probability sequence is calculated firstly by data reconstruction and CNN (Convolutional Neural Network) model transfer. Then, based on the derivative of the encryption probability sequence, the suspected encrypted field set is generated. Finally, encrypted field matching is performed based on the similarity of the four-dimensional moment eigenvector, and thus the possible encrypted field of each sample is obtained. The proposed algorithm achieved a recall rate of 93% and a precision rate of 72% in an experiment of distinguishing the encrypted/unencrypted ones of complex data. The forward coverage, reverse coverage, and F1 value in identifying encrypted field reached 89%, 90%, and 90%, respectively. Compared with the encrypted field matching methods based on the K-Nearest Neighbor algorithm, Dynamic Time Warping, Runs test, and Frequency test, the method proposed in this paper exhibited salient advantages. |
| first_indexed | 2024-12-18T00:34:31Z |
| format | Article |
| id | doaj.art-c585f6610ee8449d8cbac22cb5b6c671 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-18T00:34:31Z |
| publishDate | 2021-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-c585f6610ee8449d8cbac22cb5b6c6712022-12-21T21:27:04ZengIEEEIEEE Access2169-35362021-01-019429474295810.1109/ACCESS.2021.30631279366878An Encrypted Field Locating Algorithm for Private Protocol Data Based on Data Reconstruction and Moment EigenvectorQing Li0https://orcid.org/0000-0002-3532-8677Yonghui Ju1https://orcid.org/0000-0002-4502-7077Chang Zhao2https://orcid.org/0000-0002-0186-7701Xintai He3https://orcid.org/0000-0003-4909-2199School of Information System Engineering, PLA Strategic Support Force Information Engineering University, Zhengzhou, ChinaSchool of Information System Engineering, PLA Strategic Support Force Information Engineering University, Zhengzhou, ChinaSchool of Information System Engineering, PLA Strategic Support Force Information Engineering University, Zhengzhou, ChinaSchool of Information System Engineering, PLA Strategic Support Force Information Engineering University, Zhengzhou, ChinaEncrypted network data classification has received considerable attention in the industry and research communities for a long time. However, the emergence of new private applications and encryption protocols has brought more new challenges. The primary task of classification is to determine whether the sample is encrypted. When the specification of private protocol is unpublished, only the whole sample can be processed, and thus the unencrypted field which coexists with the encrypted field will seriously lower the classification effect. To tackle this problem, an algorithm based on data reconstruction and moment eigenvector is proposed, which can not only estimate the encryption result but also locate the encrypted field in each data sample. In the algorithm, the encryption probability sequence is calculated firstly by data reconstruction and CNN (Convolutional Neural Network) model transfer. Then, based on the derivative of the encryption probability sequence, the suspected encrypted field set is generated. Finally, encrypted field matching is performed based on the similarity of the four-dimensional moment eigenvector, and thus the possible encrypted field of each sample is obtained. The proposed algorithm achieved a recall rate of 93% and a precision rate of 72% in an experiment of distinguishing the encrypted/unencrypted ones of complex data. The forward coverage, reverse coverage, and F1 value in identifying encrypted field reached 89%, 90%, and 90%, respectively. Compared with the encrypted field matching methods based on the K-Nearest Neighbor algorithm, Dynamic Time Warping, Runs test, and Frequency test, the method proposed in this paper exhibited salient advantages.https://ieeexplore.ieee.org/document/9366878/Convolutional neural networksdiscrete sequential protocol dataderivative of discrete sequenceencrypted data classificationencryption probability sequence |
| spellingShingle | Qing Li Yonghui Ju Chang Zhao Xintai He An Encrypted Field Locating Algorithm for Private Protocol Data Based on Data Reconstruction and Moment Eigenvector IEEE Access Convolutional neural networks discrete sequential protocol data derivative of discrete sequence encrypted data classification encryption probability sequence |
| title | An Encrypted Field Locating Algorithm for Private Protocol Data Based on Data Reconstruction and Moment Eigenvector |
| title_full | An Encrypted Field Locating Algorithm for Private Protocol Data Based on Data Reconstruction and Moment Eigenvector |
| title_fullStr | An Encrypted Field Locating Algorithm for Private Protocol Data Based on Data Reconstruction and Moment Eigenvector |
| title_full_unstemmed | An Encrypted Field Locating Algorithm for Private Protocol Data Based on Data Reconstruction and Moment Eigenvector |
| title_short | An Encrypted Field Locating Algorithm for Private Protocol Data Based on Data Reconstruction and Moment Eigenvector |
| title_sort | encrypted field locating algorithm for private protocol data based on data reconstruction and moment eigenvector |
| topic | Convolutional neural networks discrete sequential protocol data derivative of discrete sequence encrypted data classification encryption probability sequence |
| url | https://ieeexplore.ieee.org/document/9366878/ |
| work_keys_str_mv | AT qingli anencryptedfieldlocatingalgorithmforprivateprotocoldatabasedondatareconstructionandmomenteigenvector AT yonghuiju anencryptedfieldlocatingalgorithmforprivateprotocoldatabasedondatareconstructionandmomenteigenvector AT changzhao anencryptedfieldlocatingalgorithmforprivateprotocoldatabasedondatareconstructionandmomenteigenvector AT xintaihe anencryptedfieldlocatingalgorithmforprivateprotocoldatabasedondatareconstructionandmomenteigenvector AT qingli encryptedfieldlocatingalgorithmforprivateprotocoldatabasedondatareconstructionandmomenteigenvector AT yonghuiju encryptedfieldlocatingalgorithmforprivateprotocoldatabasedondatareconstructionandmomenteigenvector AT changzhao encryptedfieldlocatingalgorithmforprivateprotocoldatabasedondatareconstructionandmomenteigenvector AT xintaihe encryptedfieldlocatingalgorithmforprivateprotocoldatabasedondatareconstructionandmomenteigenvector |