基于程序不变量的载荷特征提取方法  

Extraction of Payload Signature Based on Program Invariants

作　　者：葛子毅[1] 程绍银[1] 蒋凡[1] 

机构地区：[1]中国科学技术大学信息安全测评中心,安徽合肥230027

出　　处：《通信技术》2013年第9期79-82,共4页Communications Technology

基　　金：高等学校博士学科点专项科研基金新教师类资助课题(No.20113402120026);安徽省自然科学基金(No.1208085QF112);安徽省高等学校优秀青年人才基金(No.2012SQRL001ZD);中央高校基本科研业务费专项资金资助(No.WK2101020004)

摘　　要：应用层载荷特征是一种使用广泛、识别率高的指纹,但其生成主要依赖手工分析。针对该类特征的自动生成问题,提出一种基于程序不变量的指纹提取方法。该方法对应用程序进行插桩,跟踪应用程序处理协议数据包的过程,生成程序状态集并从中检测程序不变量,结合协议数据包中各个域的污点传播记录,获得数据包中存在的域间关系,进而提取出协议指纹。该方法具有效率高、不需分析协议语法语义、生成指纹精确性高等特点。Application-layer payload signature is widely used and has high recognition rate, while its extraction is always dependent on manual analysis. To automatically extract the application-layer payload signature, a method based on program invariants is proposed. With program instrument technology, the program process in dealing with network packets is tracked and program status set generated and updated, and from this the program invariants are detected. Combined with taint analysis, the relationship between the invariants and packet fields is confirmed and fingerprints are revealed. This method is of high efficiency and accuracy, with no need to analyze the protocol specification.

关 键 词：应用层载荷特征 程序不变量 动态污点传播 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]