| With the increasingly complex network environment,more and more network protocol developers choose to build private protocols to send and receive data to meet their individual needs.However,there are also many malicious applications that use private protocols to transmit network data,greatly reducing the possibility of being cracked,and at the same time making such illegal activities more secretive,posing a huge threat to network security.Therefore,analyzing and processing these unknown protocols is one of the problems that need to be solved urgently in the field of network security.Using the traditional method of reverse analysis of binary code from the software level not only achieves complexity,low portability,and inability to analyze encrypted programs,but also often faces difficulties such as the inaccessibility of protocol terminal programs and the use of anti-reverse technology in the program.Therefore,from the network data packet It is becoming more and more important to analyze the similarity between protocol messages at the level.The research goal of this thesis is to classify and format the network data packets obtained in network traffic without introducing any prior knowledge related to the protocol being reverse-analyzed,and then proceed after obtaining the protocol format and message mode.Validation analysis.In the protocol data classification,in order to distinguish a single protocol by type,this thesis first uses a packet capture tool such as WireShark to obtain the real communication data packet,uses the Ziff distribution to determine the N value of N-Gram,and further obtains the frequent item set.Thus,the clustering analysis using the multi-threshold MT-BIRCH algorithm solves the inaccurate classification problem of the traditional BIRCH algorithm in the case of large cluster size differences,so that the discrimination accuracy of different types of messages can reach 94%.In the protocol format analysis,this thesis combines the existing MAFFT algorithm and Clustal Omega algorithm to compare the sequence of messages of the same type,so that the message can still maintain a better performance even when the message contains variable-length fields and optional fields.Recognition rate.In the verification of the unknown protocol format,this thesis uses Scapy to encapsulate the message mode after the protocol format is parsed,builds a protocol message generator,and installs it on the test machine,and communicates with the target machine through the filled in IP address and port number.At the same time Use WireShark packet capture analysis and the response of the target machine to determine whether the message mode is correct.The experimental results show that the results after parsing the protocol format can obtain the response of the target machine very well.Finally,this thesis uses the springBoot back-end framework and the Vue front-end framework to design and implement a prototype system for reverse analysis and verification of unknown protocols,and uses Lincoln Lab’s DARPA data set to conduct experiments.The experimental results show that the classification,analysis and verification of the protocol format used in this thesis can be carried out with a high accuracy rate and has a high application value. |
