基于网络轨迹的协议逆向技术研究进展  

Research Progress of Network Protocol Reverse Engineering Technologies Based on Network Trace

作　　者：王占丰 程光 马玮骏 张嘉玮 孙中豪 胡超 WANG Zhan-Feng;CHENG Guang;MA Wei-Jun;ZHANG Jia-Wei;SUN Zhong-Hao;HU Chao(School of Computer Science and Engineering,Southeast University,Nanjing 211189,China;College of Cyber Science and Engineering,Southeast University,Nanjing 211189,China;Nanjing Lexbell Information Technology Co.Ltd.,Nanjing 210007,China;National Computer Network Emergency Response Technique Team/Coordination Center of China,Beijing 100020,China;College of Command Control Engineering,Army Engineering University of PLA,Nanjing 210007,China)

机构地区：[1]东南大学计算机科学与工程学院,江苏南京211189 [2]东南大学网络空间安全学院,江苏南京211189 [3]南京莱克贝尔信息技术有限公司,江苏南京210007 [4]国家计算机网络应急技术处理协调中心,北京100020 [5]解放军陆军工程大学指挥控制工程学院,江苏南京210007

出　　处：《软件学报》2022年第1期254-273,共20页Journal of Software

基　　金：国家重点研发计划(2018YFB1800200,2017YFB081703);赛尔网络下一代互联网技术创新基金(NGII20170406);东南大学博士后创新人才培养基金(2242019R20024);浙江省公益性技术应用研究计划(LGG20F020014)。

摘　　要：协议逆向广泛应用于入侵检测系统、深度包检测、模糊测试、僵尸网络检测等领域.首先给出了协议逆向工程的形式化定义和基本原理,然后针对网络运行轨迹的协议逆向方法和工具从协议格式提取和协议状态机推断两个方面对现有的协议逆向方法进行了详细分析,阐释其基本模块、主要原理和特点,最后从多个角度对现有算法进行了比较,对基于网络流量的协议逆向技术的发展趋势进行了展望和分析.Protocol reverse engineering is widely used in intrusion detection system,deep packet inspection,fuzzy testing,C&C malware detection,and other fields.First,the formal definition and basic principle of protocol reverse engineering are given.Then,the existing protocol reverse methods based on network trace are analyzed in detail from two aspects of protocol format extraction and protocol state machine inference.In addition,the basic modules,main principles,and characteristics of these algorithms are explained.Finally,the existing algorithms are compared from several aspects,and the development trend of protocol reverse technology is discussed.

关 键 词：协议逆向工程 多序列比对 语法推断 语义推断 协议状态机 

分 类 号：TP303[自动化与计算机技术—计算机系统结构]