基于逆向分析的P2P加密协议识别方案  

Identification Scheme of P2P Encryption Protocol Based on Reverse Analysis

作　　者：王晶[1] 姜珊[1] 

机构地区：[1]中国石油大学(北京)电子工程系,北京102249

出　　处：《电视技术》2014年第19期61-64,93,共5页Video Engineering

摘　　要：针对加密协议识别的难题,提出了一种基于逆向分析的协议识别方案,该方案在程序层面进行逆向分析解析出其通信过程和协议结构,在逆向分析的基础上结合流量特征对其进行识别。最后以当下最典型的Thunder为例进行试验,结果验证了方案的有效性,并能扩展到其他加密协议。该方案能够实时、准确地识别加密协议,从而能够更好地进行流量控制。Aiming at the problem of encryption protocol identification, a protocol identification scheme based on reverse analysis is proposed. In the scheme, the communication process and protocol structure in program level are analyzed, and the combined with characteristics of flow for identifica- tion. At last, take Thunder for test, the results demonstrate the effectiveness of the proposed method, and can be extended to other encryption protocols. The scheme can identify the encryption protocol in real time and accurately and control the flow better.

关 键 词：P2P加密协议 逆向分析 协议识别 THUNDER 

分 类 号：TN915.0[电子电信—通信与信息系统]