未知协议状态机推断技术研究综述  

Overview of State Machine Inference Technology for Unknown Protocols

作　　者：盛嘉杰 牛胜杰 陈阳[1] 方伟青 张玉杰 李鹏[2] 胡素君[1] SHENG Jia-jie;NIU Sheng-jie;CHENG Yang;FANG Wei-qing;ZHANG Yu-jie;LI Peng;HU Su-jun(School of Computer Science,Nanjing University of Posts and Telecommunications,Nanjing 210023,China;Institute of Network Security and Trusted Computing,Nanjing University of Postsand Telecommunications,Nanjing 210023,China)

机构地区：[1]南京邮电大学计算机学院,江苏南京210023南京邮电大学 [2]南京邮电大学网络安全与可信计算研究所,江苏南京210023

出　　处：《计算机与现代化》2023年第5期58-67,共10页Computer and Modernization

基　　金：国家自然科学基金资助项目(61872196,61872194,61902196,62102194,62102196);江苏省六大人才高峰高层次人才项目(RJFW-111);江苏省研究生科研创新计划(KYCX21_0787)。

摘　　要：协议逆向工程(PRE)描述了协议的行为逻辑,一般分为协议格式提取和状态机构造2个步骤。这2个步骤既相互关联又相互独立,在网络安全领域具有重要意义。本文全面梳理PRE协议状态机推理的相关文献,总结分析协议状态机推理的研究现状和发展趋势。首先,本文介绍PRE的形式化定义和基本原则,并讨论主要领域的具体要求。其次,分析状态机推理方法,并将其分为3种模式:聚类方法、状态相关方法和轮询状态实体方法,然后从不同的角度比较算法的逆向能力和时间效率。最后展望协议状态机推理的发展趋势。Protocol reverse engineering(PRE)describes the behavioral logic of the protocol,which is generally divided into 2 steps:protocol format extraction and state machine construction.These two steps are both interrelated and independent.PRE has important significance in the field of network security.In this paper,we have comprehensively sort out the relevant reference of protocol state machine inference.The research status and development trend of protocol state machine reasoning are summarized and analyzed.Firstly,we introduce the formal definition and basic principles of PRE and discuss the specific requirements of the main fields.Secondly,we analyze the state machine inference methods and divide them into three patterns:clustering method,state-related method,and polling state entity.Then we compare the inverse ability and time efficiency of the algorithms from dif⁃ferent perspectives.Finally,the development trend of protocol state machine reasoning is prospected.

关 键 词：协议状态机推断 协议逆向工程 协议格式提取 有限自动机 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]