| 本文已被：浏览 3577次 下载 8595次 |
码上扫一扫！ |
|
|
| 基于网络轨迹的协议逆向技术研究进展 |
|
王占丰1, 程光2, 马玮骏3, 张嘉玮4, 孙中豪4, 胡超5
|
|
1.东南大学 计算机科学与工程学院, 江苏 南京 211189;2.东南大学 网络空间安全学院, 江苏 南京 211189;3.南京莱克贝尔信息技术有限公司, 江苏 南京 210007;4.国家计算机网络应急技术处理协调中心, 北京 100020;5.解放军陆军工程大学 指挥控制工程学院, 江苏 南京 210007
|
|
| 摘要: |
| 协议逆向广泛应用于入侵检测系统、深度包检测、模糊测试、僵尸网络检测等领域. 首先给出了协议逆向工程的形式化定义和基本原理, 然后针对网络运行轨迹的协议逆向方法和工具从协议格式提取和协议状态机推断两个方面对现有的协议逆向方法进行了详细分析, 阐释其基本模块、主要原理和特点, 最后从多个角度对现有算法进行了比较, 对基于网络流量的协议逆向技术的发展趋势进行了展望和分析. |
| 关键词: 协议逆向工程 多序列比对 语法推断 语义推断 协议状态机 |
| DOI：10.13328/j.cnki.jos.006303 |
| 分类号:TP303 |
| 基金项目:国家重点研发计划(2018YFB1800200, 2017YFB081703); 赛尔网络下一代互联网技术创新基金(NGII20170406); 东南大学博士后创新人才培养基金(2242019R20024); 浙江省公益性技术应用研究计划(LGG20F020014) |
|
| Research Progress of Network Protocol Reverse Engineering Technologies Based on Network Trace |
|
WANG Zhan-Feng1, CHENG Guang2, MA Wei-Jun3, ZHANG Jia-Wei4, SUN Zhong-Hao4, HU Chao5
|
|
1.School of Computer Science and Engineering, Southeast University, Nanjing 211189, China;2.College of Cyber Science and Engineering, Southeast University, Nanjing 211189, China;3.Nanjing Lexbell Information Technology Co. Ltd., Nanjing 210007, China;4.National Computer Network Emergency Response Technique Team/Coordination Center of China, Beijing 100020, China;5.College of Command Control Engineering, Army Engineering University of PLA, Nanjing 210007, China
|
| Abstract: |
| Protocol reverse engineering is widely used in intrusion detection system, deep packet inspection, fuzzy testing, C & C malware detection, and other fields. First, the formal definition and basic principle of protocol reverse engineering are given. Then, the existing protocol reverse methods based on network trace are analyzed in detail from two aspects of protocol format extraction and protocol state machine inference. In addition, the basic modules, main principles, and characteristics of these algorithms are explained. Finally, the existing algorithms are compared from several aspects, and the development trend of protocol reverse technology is discussed. |
| Key words: protocol reverse engineering multiple sequence alignment syntax inference semantic inference protocol state machine |
