Research on Multi-layer Protocol Feature Clustering Based on KMeans

In view of the current data link layer wireless protocol identification methods, the differences in the internal protocol format of the data frame are ignored, and the data frame is treated as single-layer protocol data to process, which cannot achieve an in-depth analysis of the unknown protocol. It is proposed to use known protocols to supplement unknown protocol information, and to use the association rules between multi-type frames and characteristic fields of multi-layer protocols to classify characteristic fields of multi-layer protocols. This method uses KMeans clustering, uses the trial-and-error process and error square sum parameters to determine the optimal cluster K, uses known protocol information to optimize the cluster center point, and uses the contour coefficient to evaluate the clustering results. It can realize the effective classification of protocol characteristics, and it is of great significance to analyze the unknown protocols in depth.