基于程序不变量的载荷特征提取方法

Extraction of Payload Signature Based on Program Invariants

应用层载荷特征是一种使用广泛、识别率高的指纹,但其生成主要依赖手工分析。针对该类特征的自动生成问题,提出一种基于程序不变量的指纹提取方法。该方法对应用程序进行插桩,跟踪应用程序处理协议数据包的过程,生成程序状态集并从中检测程序不变量,结合协议数据包中各个域的污点传播记录,获得数据包中存在的域间关系,进而提取出协议指纹。该方法具有效率高、不需分析协议语法语义、生成指纹精确性高等特点。

Application-layer payload signature is widely used and has high recognition rate, while its extraction is always dependent on manual analysis. To automatically extract the application-layer payload signature, a method based on program invariants is proposed. With program instrument technology, the program process in dealing with network packets is tracked and program status set generated and updated, and from this the program invariants are detected. Combined with taint analysis, the relationship between the invariants and packet fields is confirmed and fingerprints are revealed. This method is of high efficiency and accuracy, with no need to analyze the protocol specification.