A Message Clustering Method Based on Rough Set Theory

Message clustering is useful for many security applications, including network protocol simulation, malicious protocol analysis and network protocol conformance detection. However, most of the existing message clustering methods are based on message similarity measurement, and the similarity measurement is often not accurate. To solve this problem, we proposed a message clustering method based on rough set theory. The method consists of preprocessing phase and rough set theory based clustering phase. Firstly, data stream is transformed to packets, and the messages are extracted from the packets. The messages are separated into business messages and control messages. Business messages are relatively easy to analyze, and the control messages are the main targets to cluster. Secondly, control messages are clustered on the basis of position attributions according to rough set theory, and the clustering results are simplified by the size of clusters. Experimental results show that the proposed method in this paper can cluster messages precisely.