The Frame Location And Protocol Feature Analysis From The Bit-stream In The Wireless Network

At present, with the rapidly developing of wireless networks and the widely using of related technologies, the security needs of wireless network becomes increasingly prominent. Wireless network’s transmission medium is radio waves, which is an open medium, thus, the data can be easily intercepted and counterfeited by using unknown or non-routine protocols. In the aspect of network confrontation, when a listener intercepts physical signals, he/she can not accurately locate the frames in the bit-stream nor parse frame formats for an unknown protocol. Meanwhile, the location of these binary format frames and the feature analyzing in wireless environment is the basis of upper layer unknown protocol identification and analysis. Because it is hard to capture the format of the protocol used by the other side, frame locating and feature analyzing become the difficult issues and the basis of upper layer data parsing.In this thesis, frame location technology and unknown protocol characteristics analysis techniques at home and abroad were analyzed and summarized. Also, based on multi-pattern matching algorithms, association rule mining algorithm, clustering algorithms and sequence alignment algorithm, we proposed a method of frame location and protocol feature analysis in the bit-stream captured from the wireless network environment, additionally, we capture data in the real environment and perform a series of validation experiments. This paper completed the following studies:1. For the limitations of domestic and international frame fixing technologies, we proposed a frame location algorithm which is based on the frequent partens extraction in the case of absence of prior knowledge to identify the frame synchronization code, thus, carried through frequent string extracting frame alignment and association rules. The method utilizes an improved AC algorithm to achieve statistics of all the pattern string of length m; while taking into account the performance of the algorithm problem, using association rule mining algorithm for frequent string stitching, and then found bit-stream synchronization sequence; then, we propose the use of Hamming distance detector detects a preamble in the bit-stream occurs in the position for frame alignment.2. To analyze the protocol feature in in a complete set, this paper proposes an improved clustering algorithm based on sequence alignment and frame feature algorithm analysis techniques. Use the clustering algorithm to cluster the frames from different protocols. Meanwhile, this paper presents an improved multiple sequence alignment algorithms and the corresponding bit sequence similarity threshold corresponding feature extraction sequence to identify different protocol format.3. In order to verify the effectiveness and accuracy of the proposed algorithm, we collected data from real wireless network communication environment for the verification experiment, proposed screening accuracy, data recognition rate and false recognition rate and other indexes to evaluated the experimental results. In order to verify the validity and accuracy of clustering frames, four different typical clustering algorithms were used to cluster data in different frame formats, and we compare the performance from the aspects of consumption, resource consumption, accuracy and etc., finally summarized the four algorithms’ advantages and limitations, analysised the different applying scenarios in the frame clustering method.