摘要： 研究未知网络协议逆向解析技术在网络安全应用中具有重要的意义。基于此，介绍网络协议逆向解析技术的发展现状，分析基于网络轨迹和基于数据流的2种主要解析方法，提出一种基于动态二进制分析技术的逆向解析方法，并选取DynamoRIO平台作为支撑，实现对数据流信息的记录和分析，从而解析出单条协议消息中主要的协议域。

关键词: 协议逆向解析, 数据流分析, 动态二进制分析, 协议域, DynamoRIO平台

Abstract: Research on unknown network protocol reverse parsing is of great significance in many network security applications. This paper describes the existing circumstances of protocol reverse extraction technologies, and analyses two main reverse extraction methods, one based on network trace and the other one on data flow analysis. A method based on dynamic binary analysis is presented, which aims at extracting the main protocol fields of a single message by using DynamoRIO platform to implement data flow recording and analyzing.

Key words: protocol reverse parsing, data flow analysis, dynamic binary analysis, protocol field, DynamoRIO platform

中图分类号: 

• TP393