Study On Bit Stream Oriented Unknown Frame Head Identification

In the Electronic Warfare, how to find out characteristic patterns from pure bit stream is one of the core issues in dealing with bit stream information. Therefore, protocol analysis in the bit stream is worth studying.Unknown protocol studied in this paper refers to a certain fixed header format. When large number of raw data in the same unknown protocol cumulatives, the analysis becomes posssible.The basic approach of finding out the regular pattern in bit stream is to look for characteristic sequences, and then locate the protocol header by using these sequences. Without any prior knowledge, the multi-pattern matching algorithm can process the bit stream very efficient. Furtherly, using the method of data mining, pruning on the FSM can reduce the number of database operations and get frequent sequences in a shorter time.Based on the frequent sequence mining result, association rule is introduced to locate the protocol header. The association rule is determined by the position difference between two frequent sequences because protocol header usually has relatively fixed parts.The results show that the mining method of association rules can effectively determine the structure header. But there are also some problems left. Further study can go on to optimized this algorithm and solve these problems.