计算机工程 ›› 2012, Vol. 38 ›› Issue (18): 282-285.doi: 10.3969/j.issn.1000-3428.2012.18.076

• 开发研究与设计技术 • 上一篇    下一篇

一种Cisco IOS通信过程分析方法

韩玉祥,刘胜利,刘 龙,苏晓艳   

  1. (解放军信息工程大学信息工程学院,郑州 450002)
  • 收稿日期:2011-12-15 修回日期:2012-01-18 出版日期:2012-09-20 发布日期:2012-09-18
  • 作者简介:韩玉祥(1984-),男,硕士研究生,主研方向:逆向工程,信息安全;刘胜利,副教授;刘 龙,助教;苏晓艳,硕士研究生
  • 基金项目:

    郑州市科技创新团队基金资助项目(10CXTD150)

An Analysis Method of Cisco IOS Communication Process

HAN Yu-xiang, LIU Sheng-li, LIU Long, SU Xiao-yan   

  1. (Institute of Information Engineering, PLA Information Engineering University, Zhengzhou 450002, China)
  • Received:2011-12-15 Revised:2012-01-18 Online:2012-09-20 Published:2012-09-18

摘要: Cisco IOS无法进行动态调试分析,难以截获通信过程的系统异常。为此,提出一种Cisco IOS通信过程分析方法。构建路由器硬件抽象层虚拟机,设计虚拟化动态分析平台,给出关键指令流与通信特征的提取方法,对多指令集架构、多版本的Cisco IOS进行加载实验。实验结果表明,该方法可以有效截获指定通信处理过程。

关键词: 虚拟化, 动态分析, 通信过程, 关键指令流, 有限自动机

Abstract: Cisco IOS processes can not be dynamically analyzed, and it is difficult to intercept system abnormalities of communication process. A method based on virtualaization is proposed to analyze Cisco IOS communication process. Hardware abstraction layer virtual machine is constructed, and a dynamic analysis platform based on virtualization is designed for IOS. This paper introduces methods for extracting key instruction stream and communication features. The multiple instruction set architecture and multiple versions of Cisco IOS is proved. Experimental results show that this method can effectively intercept the designated communication process.

Key words: virtualization, dynamic analysis, communication process, key instruction stream, finite automata

中图分类号: