| During network communication,the lack of formal description documentation of protocols and the lack of transparency of relevant technical information has caused problems in application scenarios such as intrusion detection,fuzz testing and protocol reuse.For this reason,researchers have proposed protocol reverse engineering,aiming to automate the analysis and processing of protocols to obtain their technical characteristics and to establish generic methods to achieve this goal.However,in recent years,the focus of research on protocol reverse engineering has been more on the parsing of protocol message formats,and not much research has been conducted on protocol state features that reflect protocol behaviour patterns and temporal state transitions.To address this situation,this paper proposes a reverse analysis method for the unknown protocol state characteristics of networks.The analysis method is based on two ideas,one is to identify the syntax format of the protocol at the syntax level,and then extract the protocol state feature fields initially with the format location information of the protocol.The second is to use the same format type of protocol state feature string to pattern match the unknown protocol state features.Finally,by comparing the state feature strings derived from the first method with the pattern matching strings,the state fields of the unknown protocols are determined by comparing the feature values and feature locations,and then inferring the behavioural logic of the sessions based on the state fields of the protocols.This thesis mainly includes the following aspects:(1)Proposes an unknown protocol state feature extraction method based on protocol syntax identification.Based on the traditional protocol association rule feature mining method,the method combines the inverse of the format features of unknown protocols and the inverse of the state features.Before mining the state features of unknown protocols,the method first identifies the format of protocols at the syntax level,clarifies the format hierarchy of protocols,and then cooperates with the protocol state location information base generated based on certain a priori knowledge to extract the state features of protocols.Unlike traditional protocol inverse analysis methods,this method combines protocol syntax feature extraction and protocol state extraction to better analyse protocols from both syntax and temporal state levels.(2)An unknown protocol state feature extraction method based on approximate value pattern matching is proposed.The method first extracts state features based on certain a priori knowledge for commonly known protocols and builds a corresponding protocol state feature library.Since the protocol specification determines that the state fields of each protocol have specific value distribution characteristics,it can be inferred that protocol sessions with similar syntax characteristics also have certain similarity in the probability distribution characteristics of each other’s state fields.As a result,the state features of known protocols with similar syntactic features can be used to match the approximate value patterns of unknown protocols,thus matching the state features of unknown protocols.The method was found to have a correct rate of over 90%when extracting the state features of multiple protocols.(3)A network unknown protocol inverse analysis system is designed and implemented.The system uses association rule mining methods to build a protocol feature library,and cooperates with protocol state feature extraction algorithms to achieve syntax identification and state feature mining of unknown protocols.The corresponding evaluation indexes are also set.The results show that the system,together with the inverse analysis method of network unknown protocol state features,can effectively complete the syntax identification and state feature mining for unknown protocols,and the system also achieves a protocol processing speed of 2000 protocols per second in terms of data processing efficiency.Moreover,the system is also based on a B/S architecture,which ensures that the system is maintainable and secure at a later stage. |
