基于状态相关字段识别的未知二进制协议状态机逆向方法  

State Reverse Method for Unknown Binary Protocol Based on State-Related Fields

作　　者：孟凡治[1] 刘渊[1] 张春瑞[1] 李桐[1] 

机构地区：[1]中国工程物理研究院计算机应用研究所,四川绵阳621900

出　　处：《电讯技术》2015年第4期372-378,共7页Telecommunication Engineering

基　　金：中国工程物理研究院科学技术发展基金(2012A040321)~~

摘　　要：协议状态机逆构技术是分析未知协议行为逻辑的基本方法,是网络安全、信息对抗领域的一个重要研究方向。针对截获的未知二进制协议的通信数据,提出了一种二进制协议状态机逆向方法,该方法能够根据通信数据逆构协议状态转移图。在该方法中,设计了针对通信数据帧的基于多序列比对的对应字段对齐算法以及基于字段统计量分析的协议状态相关字段提取算法,并根据提取出的协议状态相关字段构建状态转换模型。在地址解析协议(ARP)和传输控制协议(TCP)上的实验结果表明该方法能够有效逆构出协议的状态转换模型。Inferring protocol state machine for unknown protocol is a basic technology for understanding the protocol＇s intrinsic behavior logic,which has played an important role in the fields of network security and information countermeasure. This paper proposes a novel approach in the mining of unknown binary proto- col state machine from the communication data. It allows automatically generating the state models for bi- nary protocol by listening to network traces. A new method is presented to align the corresponding fields and extract the state related fields from binary protocol communication traces based on statistical analysis, and then construct the protocol state model based on the state related fields. The experimental results of Address Resolution Protocol（ARP） and Transmission Control Protocol（TCP） show that the approach is ef- fective.

关 键 词：信息对抗 通信数据 二进制协议 协议逆向 状态重构 状态相关字段 

分 类 号：TN918[电子电信—通信与信息系统] TP393[电子电信—信息与通信工程]