摘要： 在通信协议规范中，报文的格式类型与状态类型不存在一一映射关系，通过聚类较难将格式类型相同、状态类型不同的报文分离。为此，提出一种基于状态相关字段的二进制私有协议状态机推断方法。根据最长公共子序列距离进行状态相关字段识别，以获取协议会话的行为逻辑相似性。构建基于邻接表的初始状态机，对其进行异常会话去除与相似状态合并，从而降低协议状态机的规模。在TCP协议和SMB协议数据集上的测试结果表明，该方法能够有效推断二进制私有协议状态机，其准确率与召回率均较高。

关键词: 协议状态机, 二进制协议, 最长公共子序列距离, 邻接表, 异常会话去除, 相似状态合并

Abstract: As the one-to-one mapping relationship does not exist between the message format type and the message status type in the communication protocol specification,it is difficult to separate messages with the same format type and different status type by clustering.Therefore,a state machine inference method for binary private protocol based on state-related field is proposed.State-related field are identified according to the Longest Common Subsequence Distance(LCSD) to obtain the logical similarity of protocol sessions.An initial state machine based on adjacency table is constructed,and its abnormal session is removed and similar state is merged to reduce the size of protocol state machine.Test results on TCP and SMB protocol datasets show that the proposed method can effectively infer the state machine of binary private protocol,and both its accuracy and recall rate are high.

Key words: protocol state machine, binary protocol, the Longest Common Subsequence Distance(LCSD), adjacency table, abnormal session removal, similar state merging

中图分类号: 

• TP393