Protocol Reverse Engineering System and Its Working Method Based on Reinforcement Learning

Abstract

A protocol reverse engineering system based on reinforcement learning and its working method provided by the present invention include a decoding environment module and a decoding agent module; wherein the decoding environment module receives the state of the previous moment and the current action output by the decoding agent module, And input the new state to the decoding agent module. Compared with the prior art, the present invention has the following beneficial effects: 1) The protocol structure tree is used to represent the protocol structure. The method has strong expressive ability, rich semantics and supports complex structures. 2) An innovative protocol reverse engineering method based on deep reinforcement learning is proposed. After a large amount of data training, it has a wide range of applications and can reverse engineer data of various types of protocols. 3) When the trained decoding model performs protocol reverse, it does not need any prior knowledge or manual participation, and can fully automatically perform protocol reverse.

Description

technical field [0001] The invention relates to protocol reverse engineering, in particular to a protocol reverse engineering system and working method based on reinforcement learning. Background technique [0002] A protocol is a series of rules, standards, and conventions established for network data exchange, and is the core of computer networks and data communications. [0003] For an open protocol, such as Hyper Text Transfer Protocol (HTTP, Hyper Text Transfer Protocol), its detailed description information can be obtained from public documents (such as RFCs). [0004] But for private protocols, the protocol description information is usually not made public. [0005] Protocol reverse engineering refers to the process of obtaining application-level description information of unknown protocols. [0006] The traditional method of protocol reverse engineering is manual, which is very labor-intensive and error-prone. A typical example is the SAMBA project. The SAMBA pr...

AI Technical Summary

Problems solved by technology

[0015] 2) The invention can only find the positions of some fields with semantic features, and cannot obtain the complete protocol message format;

[0019] 1) It is only segmented, and complete information such as the encoding method of each field is not deduced;

[0020] 2) Does not support complex nested structures;

[0026] Existing technologies have defects such as requiring additional prior knowledge, supporting few types of protocols, not being able to recognize protocols with complex structures, and inferring protocol specifications that are incomplete and unclear.

Images