SPFPA:一种面向未知安全协议的格式解析方法

SPFPA:A Format Parsing Approach for Unknown Security Protocols

针对未知安全协议的格式解析方法是当前信息安全技术中亟待解决的关键问题.现有基于网络报文流量信息的方法仅考虑报文载荷中的明文信息,不适用于包含大量密文信息的安全协议.针对该问题,提出一种新的面向未知安全协议的格式解析方法(security protocols format parsing approach,SPFPA).SPFPA首次利用序列模式挖掘方法层次化、序列化提取协议的关键词序列特征,为明文信息格式解析提供一种新的解决思路,并在此基础上给出查找协议密文长度域的启发式规则,进而利用密文数据的随机性特征确定密文域.实验结果表明,该方法在不借助任何主机运行特征的基础上,仅依靠网络报文数据即能够有效解析未知安全协议的不变域、可变域、密文长度域及相应的密文域,并具有较高的准确率.

Format parsing for unknown security protocols is a critical problem that needs to be solved in the information security field.However,previous network-trace-based format parsing methods have only considered the plaintext format of payload data,and have not been suitable for security protocols which include a large number of ciphertext data.In this paper,to infer the message format of unknown security protocols from a large mount of network traces,we propose a novel format parsing approach-named SPFPA（security protocols format parsing approach）.SPFPA presents a hierarchical method to extract the protocol keywords sequences using sequential pattern mining for the first time,which provides a new idea for plaintext format parsing.On this basis,SPFPA introduces a set of heuristics to search the possible ciphertext length fields,and then identifies ciphertext length fields and the corresponding ciphertext fields by using the randomness feature of ciphertext data.Finally we evaluate SPFPA on four classical security protocols,i.e.SSL protocol,SSH protocol,Needham-Schroeder（NS）public key protocol and sof protocol.Our experimental results show that without using dynamic binary analysis,SPFPA can parse true protocol format effectively,i.e.invariant fields,variable fields,ciphertext length fields and ciphertext fields,purely from network traces,and the inferred formats are highly accurate in identifying the protocols.