摘要
协议逆向广泛应用于入侵检测系统、深度包检测、模糊测试、僵尸网络检测等领域.首先给出了协议逆向工程的形式化定义和基本原理,然后针对网络运行轨迹的协议逆向方法和工具从协议格式提取和协议状态机推断两个方面对现有的协议逆向方法进行了详细分析,阐释其基本模块、主要原理和特点,最后从多个角度对现有算法进行了比较,对基于网络流量的协议逆向技术的发展趋势进行了展望和分析.
Protocol reverse engineering is widely used in intrusion detection system,deep packet inspection,fuzzy testing,C&C malware detection,and other fields.First,the formal definition and basic principle of protocol reverse engineering are given.Then,the existing protocol reverse methods based on network trace are analyzed in detail from two aspects of protocol format extraction and protocol state machine inference.In addition,the basic modules,main principles,and characteristics of these algorithms are explained.Finally,the existing algorithms are compared from several aspects,and the development trend of protocol reverse technology is discussed.
作者
王占丰
程光
马玮骏
张嘉玮
孙中豪
胡超
WANG Zhan-Feng;CHENG Guang;MA Wei-Jun;ZHANG Jia-Wei;SUN Zhong-Hao;HU Chao(School of Computer Science and Engineering,Southeast University,Nanjing 211189,China;College of Cyber Science and Engineering,Southeast University,Nanjing 211189,China;Nanjing Lexbell Information Technology Co.Ltd.,Nanjing 210007,China;National Computer Network Emergency Response Technique Team/Coordination Center of China,Beijing 100020,China;College of Command Control Engineering,Army Engineering University of PLA,Nanjing 210007,China)
出处
《软件学报》
EI
CSCD
北大核心
2022年第1期254-273,共20页
Journal of Software
基金
国家重点研发计划(2018YFB1800200,2017YFB081703)
赛尔网络下一代互联网技术创新基金(NGII20170406)
东南大学博士后创新人才培养基金(2242019R20024)
浙江省公益性技术应用研究计划(LGG20F020014)。
关键词
协议逆向工程
多序列比对
语法推断
语义推断
协议状态机
protocol reverse engineering
multiple sequence alignment
syntax inference
semantic inference
protocol state machine
