计算机工程 ›› 2019, Vol. 45 ›› Issue (5): 84-87.doi: 10.19678/j.issn.1000-3428.0050950

• 移动互联与通信技术 • 上一篇    下一篇

基于位置的自动化网络流协议逆向分析方法

侯方杰,王雷,王嵩,盛捷   

  1. 中国科学技术大学 信息科学技术学院 自动化系,合肥 230001
  • 收稿日期:2018-03-27 出版日期:2019-05-15 发布日期:2019-05-15
  • 作者简介:侯方杰(1991—),男,硕士研究生,主研方向为未来网络、网络协议解析;王雷,副教授、博士;王嵩、盛捷,讲师、博士
  • 基金项目:

    国家科技重大专项(2017ZX03001019-004);中国科学院战略性先导科技专项(XDA06011203)

Position-based automated protocol reverse analysis method on network flows

HOU Fangjie,WANG Lei,WANG Song,SHENG Jie   

  1. Department of Automation,School of Information Science and Technology, University of Science and Technology of China,Hefei 230001,China
  • Received:2018-03-27 Online:2019-05-15 Published:2019-05-15

摘要:

现有自动化网络流协议逆向分析方法处理含有大量二进制报文数据的协议时难以准确推断报文格式。为此,提出一种改进的自动化网络流协议逆向分析方法(PoKE)。通过为关键词添加位置属性,提取出二进制报文数据中长度较短的关键词。利用关键词对报文进行标记,根据标记序列建立协议状态转移模型,同时采用基于报文分割和关键词提取的递归循环方式,实现更全面的关键词信息提取。实验结果表明,与Biprominer方法相比,PoKE方法能提取出更多的关键词信息,从而建立更精确的二进制协议模型。

关键词: 协议逆向, 网络流, 二进制协议, 位置属性, 关键词提取

Abstract:

Existing automated network flows protocol reverse method is difficult to infer message format accurately when dealing with protocols with a large number of binary message data.This paper proposes an improved automated network flows protocol reverse analysis method called PoKE.By adding the position attribute to the keywords,PoKE extracts the short-length keywords from the binary message data,uses keywords to mark the messages,and establishes a state transition model of the protocol according to the marked message sequences.At the same time,PoKE extracts more detailed keywords information through recursive looping mode based on message segmentation and keywords extraction.Experimental results show that PoKE method can extract more keywords information than Biprominer method,thereby establishing a more accurate binary protocol model.

Key words: protocol reverse, network flow, binary protocol, position attribute, keyword extraction

中图分类号: