基于相似度匹配的网络协议语法分析方法  

Analysis of the Network Protocol Syntax Based on Similarity Matching

作　　者：郭亮[1] 罗森林[1] 潘丽敏[1] 

机构地区：[1]北京理工大学信息系统及安全对抗实验中心,北京100081

出　　处：《北京理工大学学报》2016年第5期520-523,共4页Transactions of Beijing Institute of Technology

基　　金：北京理工大学科技创新计划重大项目(2011CX01015);国家"二四二"计划项目(2005C48)

摘　　要：为解决网络协议语法分析方法中,依赖人工干预、分析效率低下、分析范围较小等问题,提出一种基于相似度匹配的网络协议语法分析方法.通过嗅探采集网络原始数据包,解析基础协议并对数据包进行预处理,提取9维不同角度的特征,建立了网络协议语法相似分析模型,分析网络协议细节语法特征.通过将TCP协议作为已知协议,对UDP、DNS、QQ等3种不同类型的协议测试,结果表明这3类协议报头中,33%以上的字段能在TCP协议中找到对应的相似语法,而且平均准确率均在96%以上,该方法不需人工干预,可以提高分析效率、减少限制条件、扩大分析范围,并能较为有效地分析出网络协议语法特征.To solve the problems in analysis of the network protocol syntax,which are rely on human intervention,low efficiency and narrow scope,a method was proposed for analysis of network protocol syntax based on similarity matching. The main process of the method include collecting the raw packets by network sniffer,and then preprocessing the packets,using a variety of methods for 9 features extraction,establishing a network protocol syntax analysis model based on similarity matching method,to analyze the syntax feature of network protocol. Taking the TCP protocol as a known protocol,experiments were actualized with different types of protocols as UDP,DNS and QQ. The results show that in the three types of protocol header,more than 33% of the correct similar syntax fields can be found in TCP protocol,and the average accuracy rate was over 96%,the process needs not manual intervention,it can improve the analysis efficiency,reduce the constraints,expand the scope of the analysis,and analyze the network protocol syntax more effectively.

关 键 词：协议语法分析 协议逆向 相似度匹配 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]