A protocol field inverse analysis system and method based on BWT

Abstract

The invention provides a protocol field reverse analysis system and method based on BWT. Specific suffix index is constructed, so that specific substring matching only needs to be completed once in each alignment process. Moreover, the alignment algorithm based on suffix index is flexible in design, consumes less space in the index stage, and the length of subsequence is variable, protocol fieldscan be quickly identified. After the fixed field is identified, the invention counts the fields with high frequency through a random multi-stream multi-segment matching method, constructs a grammar tree according to the field position and the number of the fields, extracts the field structure, and thus realizes the inverse of the field format. After being classified, the reverse field is used asthe input of the fuzzy test tool, a large number of deformity test cases is sent to the target communication entity, and at the same time, the debugger is combined with the sniffer to carry out abnormal monitoring on the target communication entity, the abnormality is found and analyzed, so as to subsequently improve the safety of the target communication entity.

Description

technical field [0001] The invention relates to the field of network protocols, in particular to a BWT-based protocol field reverse analysis system and method. Background technique [0002] With the popularization of Internet technology, there are more and more researches related to network protocols, many of which are based on the detailed description information of the protocol, that is, the protocol specification, so the role of the protocol reverse field is becoming more and more important. Protocol refers to a set of rules and agreements that must be followed when various communication entities in computer networks and distributed systems exchange information with each other. Both parties exchanged information methodically and reliably. There are not only a large number of standardized communication protocols in the network, but also a large number of private protocols in the network, that is, unknown protocols. The emergence of unknown protocols is partly due to the ...

AI Technical Summary

Problems solved by technology

Satisfactory results can be achieved when the similarity of the sequence samples is high. If the sequence differences are large, the comparison effect will be seriously affected.

Images