摘要
对未知网络协议进行逆向解析在网络安全应用中具有重要的意义。现有的协议逆向解析方法大都存在无法处理加密协议和无法获取协议字段语义信息的问题。针对这一问题,提出并实现了一种基于数据流分析的网络协议解析技术。该技术依托动态二进制插桩平台Pin下编写的数据流记录插件,以基于数据关联性分析的数据流跟踪技术为基础,对软件使用的网络通信协议进行解析,获取协议的格式信息,以及各个协议字段的语义。实验结果证明,该技术能够正确解析出软件通信的协议格式,并提取出各个字段所对应的程序行为语义,尤其对于加密协议有不错的解析效果,达到了解析网络协议的目的。
Reverse parsing unknown network protocol is of great significance in many network security applications. Most of the existing protocol reverse parsing methods can not handle the encryption protocol or get the semantic information of the protocol field. To solve this problem, a network protocol parsing technique based on dataflow analysis was proposed. According to the data flow recording tool developed on Pin platform, it could parse the network protocol with the aid of the dependence analysis based data flow tracking technology, as well as obtain the protocol format and semantic information of each protocol field. The experimental results show that the technique can parse out the protocol format correctly, especially for the encryption protocol, and extract the program behavior semantics of each protocol field.
出处
《计算机应用》
CSCD
北大核心
2013年第5期1217-1221,共5页
journal of Computer Applications
关键词
数据流分析
网络协议逆向
加密协议解析
动态二进制插桩
协议字段语义
dataflow analysis
network protocol reverse
encryption protocol parsing
dynamic binary instrumentation
protocol field semantic
