| The specification of network protocol plays a crucial role in the Internet communication and network protection, such as scenes like network instruction detection, secret channel discovery, deep packet analysis, and botnet detection, etc. For noncooperate targets, the specifications of their communication protocols are usually unknown, and the executable programs are unreachable even worse. This calls the research of protocol specification reversal based on net-trace(packets from the Internet) for non-cooperate targets which we can only capture their communication packets, by which means we can get the format of unknown protocols, and enhance the detection of network intrusion and botnet, and further more strengthen the security of computer system and network system.Considering the method of cluster division and cluster combination, firstly, we cluster the source packets based on the attribute and data of protocol key words using cluster division. Then, combine the similar clusters based on sequence alignment and get a relatively ideal result eventualy.Aiming at the method of protocol format reversal based on packets data from the network, this paper proposed a protocol format reversal scheme which is a intergration of cluster devision based on protocol foramat key words and cluster combination based on sequence alignment.The data initial processing is done in the cluster division stage. Firstly, divide the packet into tokens and sign them with token attributs. Then cluster the packets by key words which can distinguish different packet types and construct the protocol format template at the same time.In the cluster combination stage, we decrease the redundancy of the clusters. By calculate the similarity of two cluster templates, we combine the cluster pairs which have high similarity of their format templates. In this way, the whole redundancy of the clusters is reduced and the format templates of each cluster is updated accordingly.A packet parsing tool is used to examine the proposed scheme. According to the procedure and result of our experiment, this method can partation and recognise the unknown protocol format, and achieve a relatively ideal result in the packet cluster and format template construction. |
