Search

Protocol reverse engineering is crucial in normative verification, and malware behavior analysis and vulnerability discovery. However, uncovering the structural features of binary protocols concealed within dense data representations remains a significant challenge. Accurately identifying keyword segments associated with message types is a prerequisite for meaningful semantic analysis and protocol state machine reduction. In this work, we introduce a novel approach for inferring keywords from binary protocols based on probabilistic statistics. Our method in terms of Byte employs heuristic rules to filter offset positions that are clearly unrelated to message types. We further filter candidate Byte-offsets utilizing constraint relations and provide the probabilistic ranking of each offset as the keyword segment. To enhance the reliability of keyword segment inference, we utilize the Monte Carlo algorithm to assess the difference between message clustering with candidate Byte-offset and random message clustering, and reorder candidate offsets according to the results. Then we can observe optimal values from both orderings and present the ultimate inference results. Experimental results demonstrate that our method excels in the accuracy of keyword segments identification compared with previous techniques. [ABSTRACT FROM AUTHOR]

Climate data derived from long-term, multisource altimeter significant wave height (SWH) measurements are more valuable than those obtained from a single altimeter source. Such data facilitate exploration of long-term air–sea momentum transfer and more comprehensive investigation of weather system dynamics processes over the ocean. Despite the deployment of the first satellite in the Chinese Haiyang-2 (HY-2) series more than 12 years ago, validation and integration of SWH data from China's offshore waters, derived using Chinese altimeters, have been limited. This study constructed a high-resolution, long-term, multisource gridded SWH climate dataset using along-track data from the HY-2 series, CFOSAT, Jason-2, Jason-3, and Cryosat-2 altimeters. Validation against observations from 31 buoys covering China's offshore waters indicated that the SWH variances from HY-2A, HY-2B, HY-2C, CFOSAT, and Jason-3 altimeters correlated well with observations, with a temporal correlation coefficient of approximately 0.95 (except HY-2A, correlation: 0.89). These SWH measurements generally showed a robust linear relationship with the buoy data. Additionally, cross-calibration between Jason-3 and the HY-2A, HY-2B, HY-2C, and CFOSAT altimeters also demonstrated a typically linear relationship for SWH > 6.0 m. Using this relationship, the SWH data were linearly corrected and integrated into a 10 d mean, long-term, multisource altimeter gridded SWH dataset. Compared with in situ observations, the merged 10 d mean SWHs are more accurate and closely match the observations, with temporal correlation coefficients improving from 0.87 to 0.90 and bias decreasing from 0.28 to 0.03 m. The merged gridded SWHs effectively represent the local spatial distribution of SWH. This study revealed the importance of observational data in the process of merging and recalibrating long-term multisource altimeter SWH datasets, particularly before their application in specific ocean regions. [ABSTRACT FROM AUTHOR]

Deep learning has achieved good classification results in the field of traffic classification in recent years due to its good feature representation ability. However, the existing traffic classification technology cannot meet the requirements for the incremental learning of tasks in online scenarios. In addition, due to the high concealment and fast update speed of malicious traffic, the number of labeled samples that can be captured is scarce, and small samples cannot drive neural network training, resulting in poor performance of the classification model. Therefore, this paper proposes an incremental learning method for small-sample malicious traffic classification. The method uses the pruning strategy to find the redundant network structure and dynamically allocates redundant neurons for training based on the proposed measurement method according to the difficulty of the new class. This enables the network to perform incremental learning without excessively consuming storage and computing resources, and reasonable allocation improves the classification accuracy of new classes. At the same time, through the knowledge transfer method, the model can reduce the catastrophic forgetting of the old class, relieve the pressure of training large parameters with small-sample data, and improve the model classification performance. Experiments involving multiple datasets and settings show that our method is superior to the established baseline in terms of classification accuracy, consuming 50% less memory. [ABSTRACT FROM AUTHOR]