Text protocol reverse resolution method and system

Abstract

The invention provides a text protocol reverse resolution method and a text protocol reverse resolution system. The method comprises the following steps that: a plurality of network data packets of a text protocol are captured, application layer data is extracted from each network data packet and is converted into data streams in a text form, and a plurality of obtained data streams form a data set; separators are used for carrying out segmentation processing on each data stream in the data set, the contents of each data stream are divided into a plurality of data items, and position information of each data item is recorded; for each data item, whether the data item is a feature item or not is determined according to the position information of the data item and the occurring times of the data item in the data streams and the data set; the identical feature items in each data stream are extracted in lines, the feature items are used as fixed fields, and adjacent non-feature items are merged to be used as variable fields; and cluster analysis is carried out, and the format features of the text protocol are determined. The method and the system have the advantages that the commonality and the relevance are analyzed from a great number of data packets of the same text protocol, and the protocol format is obtained, so the reverse resolution is preciser.

Description

technical field [0001] The present invention relates to a protocol reverse analysis, more specifically, to a text protocol reverse analysis method and system. Background technique [0002] In the process of information interaction between different computer systems, network communication protocols play an irreplaceable role and receive more and more attention. The format of protocol messages is essential to many network security applications, such as vulnerability mining, intrusion detection systems, and so on. But many network application protocols are not open, especially in enterprise networks, there are fewer and fewer formal protocol description documents, so that people cannot directly obtain the characteristics of protocol messages through protocol specifications. Protocol reverse analysis does not depend on protocol specifications or descriptions. By analyzing technical methods such as protocol data packets or interaction processes, information such as format fields...

AI Technical Summary

Problems solved by technology

[0007] The disadvantage of the dynamic analysis method based on the program execution trajectory is that the program execution trajectory needs to be recorded in real time during the program execution process, and there is no public tool for real-time recording, so it is difficult to obtain the analysis object, and the real-time recording of the program execution trajectory is required. It requires a lot of time and space overhead, and only processes a single protocol message each time, resulting in low accuracy

Images