基于网络数据流的未知密码协议逆向分析

Unknown Cryptographic Protocol Reverse Engineering Based on Network Flows

针对新的应用和协议不断涌现而导致的网络数据流无法识别的问题,对未知密码协议逆向分析技术进行了研究。首先,对密码协议的行为模式进行分析,将密码协议分为安全连接建立阶段和数据传输阶段;其次,分析了安全连接建立阶段和数据传输阶段的数据特点,提出从安全连接建立阶段入手进行密码协议逆向分析的思想;针对密码协议变长字段多的特点,提出了随机采样、多序列对齐、数据挖掘相结合的字段划分方案,提高了字段划分的准确性和效率;分析了长度字段的特点,提出了长度字段的特征提取方法。基于网络数据流的未知密码协议逆向分析技术为网络监管提供技术支撑。

To overcome problems in identifying unknown cryptographic protocols applied in new applications,a method aimed at solving unknown cryptographic protocol reverse engineering based on network flows is proposed.Firstly,this paper analyzes the basic modes of traditional cryptographic protocol,and split the protocol into two different stages,that is secure connection establishment stage and data transmission stage.Then,it analyzes the data features of the two stages,and proposes the idea of reverse engineering from the first stage to gain information about the protocol.Finally,according to the features of many variable-length fields in cryptographic protocols,a new scheme combing random sampling,multi-sequence alignment and data mining is proposed,which improves the accuracy and efficiency of field division.At the same time,this paper proposes a novel technique to identify length field to further improve the correctness of protocol format parsing.Techniques here can be used to strengthen network supervision.