基于报文匹配与GRU-ATT模型的协议逆向分析方法  

Protocol reverse analysis method based on message matching and GRU-ATT

作　　者：付饶 袁丁 刘琦 史晓桢 李丹奇 FU Rao;YUAN Ding;LIU Qi;SHI Xiaozhen;LI Danqi(State Grid Xuzhou Power Supply Company,State Grid Jiangsu Electric Power Co.Ltd.,Xuzhou 221000,China)

机构地区：[1]国网江苏省电力有限公司徐州供电分公司,徐州221000

出　　处：《江苏科技大学学报(自然科学版)》2024年第6期76-82,共7页Journal of Jiangsu University of Science and Technology:Natural Science Edition

基　　金：国网江苏省电力有限公司科技项目(J2022014)。

摘　　要：针对未知网络协议逆向分析中的报文分类问题,提出了一种基于报文交互匹配与GRU-ATT模型的未知网络协议逆向分析方法MemProRe,结合多序列比对和深度学习方法,采用基于注意力机制的CNN-GRU-Attention网络,在客户端与服务器端交互报文集合之间的一致性约束条件下,将双端报文分类的结果进行特征融合,从而实现未知网络协议的报文分类.实验结果表明,MemProRe方法能够有效解决报文分类的冗余问题,提升了报文分类的精确率约10%以上.Aiming at the problem of message classification in unknown network protocol reverse analysis, we propose an unknown network protocol reverse analysis method based on message interaction matching and GRU-ATT model, named MemProRe. Coupled with multiple sequence alignment and deep learning methods, it adopts CNN-GRU-Attention network based on attention mechanism. Under the condition of consistency constraint of the interaction message set between the client and the server, the features of the double-end message classification results are fused to realize the message classification. The experimental results demonstrate that the MemProRe can effectively solve the problem of redundancy of message classification and improve the accuracy of message classification more than 10%.

关 键 词：协议逆向分析 多序列比对 报文交互匹配 门控循环单元 注意力机制 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]