Application Layer Protocol Identification Method Based on ResNet
Most network attacks occur at the application layer, where many application layer protocols exist. These protocols have different structures and functionalities, posing feature extraction challenges and resulting in low identification accuracy. This significantly affects application layer protocol r...
Saved in:
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2025-01-01
|
| Series: | Algorithms |
| Subjects: | |
| Online Access: | https://www.mdpi.com/1999-4893/18/1/52 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1832589432006377472 |
|---|---|
| author | Zhijian Fang Xiang Gao Huaxiong Zhang Jingpeng Tang Qiang Gao |
| author_facet | Zhijian Fang Xiang Gao Huaxiong Zhang Jingpeng Tang Qiang Gao |
| author_sort | Zhijian Fang |
| collection | DOAJ |
| description | Most network attacks occur at the application layer, where many application layer protocols exist. These protocols have different structures and functionalities, posing feature extraction challenges and resulting in low identification accuracy. This significantly affects application layer protocol recognition, analysis, and detection. We propose a data protocol identification method based on a Residual Network (ResNet) to address this issue. The method involves the following steps: (1) utilizing a delimiter determination algorithm based on information entropy proposed in this paper to determine an optimal set of delimiters; (2) segmenting the original data using the optimal set of delimiters and constructing a feature data block frequency table based on the frequency of segmented data blocks; (3) employing a composite-feature-based RGB image generation algorithm proposed in this paper to generate feature images by combining feature data blocks and original data; and (4) training the ResNet model with the generated feature images to automatically learn protocol features and achieve classification recognition of application layer protocols. Experimental results demonstrate that this method achieves over 98% accuracy, precision, recall, and F1 score across these four metrics. |
| format | Article |
| id | doaj-art-d951b5e47e8841ec86cc0139f69bc3d2 |
| institution | Kabale University |
| issn | 1999-4893 |
| language | English |
| publishDate | 2025-01-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Algorithms |
| spelling | doaj-art-d951b5e47e8841ec86cc0139f69bc3d22025-01-24T13:17:37ZengMDPI AGAlgorithms1999-48932025-01-011815210.3390/a18010052Application Layer Protocol Identification Method Based on ResNetZhijian Fang0Xiang Gao1Huaxiong Zhang2Jingpeng Tang3Qiang Gao4School of Computer Science and Technology (School of Artificial Intelligence), Zhejiang Sci-Tech University, Hangzhou 310018, ChinaSchool of Information Science and Engineering, Zhejiang Sci-Tech University, Hangzhou 310018, ChinaSchool of Computer Science and Technology (School of Artificial Intelligence), Zhejiang Sci-Tech University, Hangzhou 310018, ChinaDepartment of Computer Science, Utah Valley University, Orem, UT 84058, USASchool of Media Engineering, Communication University of Zhejiang, Hangzhou 310018, ChinaMost network attacks occur at the application layer, where many application layer protocols exist. These protocols have different structures and functionalities, posing feature extraction challenges and resulting in low identification accuracy. This significantly affects application layer protocol recognition, analysis, and detection. We propose a data protocol identification method based on a Residual Network (ResNet) to address this issue. The method involves the following steps: (1) utilizing a delimiter determination algorithm based on information entropy proposed in this paper to determine an optimal set of delimiters; (2) segmenting the original data using the optimal set of delimiters and constructing a feature data block frequency table based on the frequency of segmented data blocks; (3) employing a composite-feature-based RGB image generation algorithm proposed in this paper to generate feature images by combining feature data blocks and original data; and (4) training the ResNet model with the generated feature images to automatically learn protocol features and achieve classification recognition of application layer protocols. Experimental results demonstrate that this method achieves over 98% accuracy, precision, recall, and F1 score across these four metrics.https://www.mdpi.com/1999-4893/18/1/52protocol identificationResNetinformation entropycomposite feature data |
| spellingShingle | Zhijian Fang Xiang Gao Huaxiong Zhang Jingpeng Tang Qiang Gao Application Layer Protocol Identification Method Based on ResNet Algorithms protocol identification ResNet information entropy composite feature data |
| title | Application Layer Protocol Identification Method Based on ResNet |
| title_full | Application Layer Protocol Identification Method Based on ResNet |
| title_fullStr | Application Layer Protocol Identification Method Based on ResNet |
| title_full_unstemmed | Application Layer Protocol Identification Method Based on ResNet |
| title_short | Application Layer Protocol Identification Method Based on ResNet |
| title_sort | application layer protocol identification method based on resnet |
| topic | protocol identification ResNet information entropy composite feature data |
| url | https://www.mdpi.com/1999-4893/18/1/52 |
| work_keys_str_mv | AT zhijianfang applicationlayerprotocolidentificationmethodbasedonresnet AT xianggao applicationlayerprotocolidentificationmethodbasedonresnet AT huaxiongzhang applicationlayerprotocolidentificationmethodbasedonresnet AT jingpengtang applicationlayerprotocolidentificationmethodbasedonresnet AT qianggao applicationlayerprotocolidentificationmethodbasedonresnet |