Protocol reverse analysis method, computer readable storage medium and program product

Abstract

The invention discloses a protocol reverse analysis method, a computer readable storage medium and a program product, and relates to the field of information countermeasure, and the method comprises the steps: employing variable sliding window coarse search, and determining the minimum width of a sliding window containing the length of a whole frame; determining the width of a fixed sliding window according to the minimum width of the sliding window, and determining a frame header and a frame tail by adopting the fixed sliding window for precise search; segmenting the data stream according to the frame header and the frame tail; determining whether the frame type is fixed-length or variable-length according to a result of accurate search of the fixed sliding window; carrying out statistics on each frame of segmented data, and determining the length of a synchronization word; forming a frame structure-keyword template according to priori knowledge; the frame structure analysis result comprises a frame header, a frame tail, a synchronous word length and a frame type, and matching the frame structure analysis result with a frame structure-keyword template to obtain an analytic value and a speculative value of an actual keyword or obtain a new sample. On the basis of demodulation of a physical layer and a link layer, parameter identification is carried out on a communication protocol under the condition of no prior information or less prior information for a data stream.

Description

Technical Field

[0001] The present invention relates to a protocol reverse analysis method for wireless communication signals, a computer-readable storage medium and a program product, and belongs to the field of wireless communication and information confrontation. Background Art

[0002] With the rapid development of technologies such as communication and artificial intelligence, various types of wireless communication protocols have also become diverse. Accurately identifying the parameters of the communication protocol based on the identification of signal-level parameters such as the physical layer and link layer of the communication signal, especially performing protocol parsing in the absence of prior information or with little prior information, can be used for consistency, integrity and availability testing and analysis of wireless communication collaboration, intrusion detection and signal recognition, fuzzy testing, protocol vulnerability mining and security analysis, etc., and has important theoretical value and practical significance.

[0003] In terms of protocol message format extraction, it mainly describes the value range and meaning of different fields in the protocol message. 1) Message format analysis: In 2004, Beddoe proposed the PI (Protocol Information Project) project, which applied the multiple sequence alignment technology (MSA) in biology to network protocol analysis. Since then, ScriptGen, Netzob, Li Weiming's automated fuzz testing, Prodecoder, etc. have all borrowed this technology. 2) Protocol keyword extraction: Antunes regards the message format as a regular language and extracts keywords based on the partial order alignment algorithm; Luo et al. obtain protocol keywords by analyzing word frequency; Vertas uses statistical algorithms to analyze message formats; Biprominer uses variable-length pattern recognition methods for extraction, etc. 3) Protocol domain division: Shevertalov proposed to cluster different message types based on the length of the longest common subsequence (LCS) in the protocol reverse engineering PEXT; Cui et al. proposed to divide subclasses by marking the text domain and binary domain in the protocol, and classify them according to the cluster values. 4) Semantic analysis: Currently, it is mainly based on statistical methods and natural pre-research processing methods, including Discoverer, Prodecoder, ASAP, and Trifilo's message format reverse analysis method based on content distribution characteristics.

[0004] In terms of protocol behavior specification mining, the main focus is on describing the process of the protocol subject processing messages. Currently, it is mainly described through the Finite State Machine (FSM) model, specifically including passive inference algorithms and active inference algorithms. The BFS algorithm proposed by Reverx, Trifilo, etc. and the ECGI-based inference algorithm proposed by ScriptGen, Xiao Mingming, etc. that use passive analysis algorithms to implement protocol state machine analysis are well applied in the protocol reverse analysis methods proposed by Netzob, Cho, etc. Summary of the invention

[0005] The technical problem solved by this application is: to overcome the shortcomings of the prior art and provide a protocol reverse parsing method for wireless communication signals, which is used in wireless communication equipment such as satellite communication systems, Internet of Things systems, and unmanned communication terminals. It mainly identifies parameters of communication protocols based on data streams without or with little prior information based on physical layer and link layer demodulation. It is mainly achieved through two steps: frame structure analysis and frame keyword analysis.

[0006] The specific technical problems solved are as follows:

[0007] (1) For various frame structures, the variable sliding window coarse search + fixed sliding window fine search method is used to realize blind recognition of various fixed-length and variable-length frame structures, solving the problem of rapid recognition of various frame structures under the condition of insufficient prior information.

[0008] (2) For complex and changeable keywords, the entire keyword analysis work is completed by using the template induction-template matching-template addition method, which is fully compatible with the existing classification methods and realizes the generation of accurate values ​​and inferred values.

[0009] The technical solutions provided by this application are as follows:

[0010] A protocol reverse analysis method for wireless communication signals, comprising:

[0011] S1: Use variable sliding window rough search to determine the minimum sliding window width that includes the entire frame length;

[0012] S2: Determine the fixed sliding window width according to the minimum sliding window width determined by S1, use the fixed sliding window fine search to determine the frame header and frame tail; and divide the data stream according to the frame header and frame tail;

[0013] S3: According to the result of the fixed sliding window refined search, confirm whether the frame type is fixed length or variable length;

[0014] S4: Count the data of each frame and determine the length of the synchronization word;

[0015] S5: forming a frame structure based on prior knowledge - keyword template;

[0016] S6: The frame structure analysis result includes the frame header, frame tail, synchronization word length and frame type. The frame structure analysis result is matched with the frame structure-keyword template to obtain the parsed value, inferred value of the actual keyword or obtain a new sample.

[0017] In S1, a variable sliding window rough search is used to determine the minimum width of the sliding window that includes the entire frame length, including:

[0018] S11, slidingly intercepting the data stream with a sliding window of a first width, and performing a correlation operation with the data stream itself to obtain a first correlation peak spectrum;

[0019] S12, increasing the width of the sliding window, wherein the second width is greater than the first width, slidingly intercepting the data stream with the sliding window of the second width, and performing a correlation operation with the data stream itself to obtain a second correlation peak spectrum;

[0020] S13, continue to repeat the above step S12 to obtain the third correlation peak spectrum... a series of Ith correlation peaks, where I is a positive integer;

[0021] S14. As the width of the sliding window increases, the heights of the obtained series of correlation peaks gradually increase until, for the sliding window of the mth width and the sliding window of the m+1th width, m and m+1 are both ∈ [1, I], and the height of the corresponding m+1th correlation peak spectrum is ≤ the height of the mth correlation peak spectrum. At this time, the width of the sliding window of the mth width is used as the minimum width of the sliding window that contains the entire frame length.

[0022] In S2, according to the minimum sliding window width determined in S1, a fixed sliding window width is determined, and a fixed sliding window fine search is used to determine the frame head and the frame tail, including:

[0023] Fixed sliding window width = sliding window minimum width × expansion window coefficient;

[0024] The fixed sliding window is made to slide to slide and intercept the data stream, and a correlation operation is performed with the data stream itself to obtain a correlation peak spectrum. The two highest and repeated correlation peaks in the correlation peak spectrum are the frame headers of two consecutive frames or the frame tails of two consecutive frames. The frame header and the frame tail are determined by the length corresponding to the position interval of the two highest and repeated correlation peaks in the correlation peak spectrum.

[0025] The expansion window coefficient is 1-1.5.

[0026] In the S4, the divided frame data are counted to determine the synchronization word length, including: the highest frequency of the same part in each frame data is taken as the fixed field; the part connected to the fixed field, the part with a higher frequency of the same bit is the length of the variable field; the length of the variable field plus the length of the fixed field is taken as the synchronization word length.

[0027] In S6, the frame structure analysis result is matched with the frame structure-keyword template to obtain the parsed value, estimated value or new sample of the actual keyword, including:

[0028] If the frame structure analysis result matches the frame structure of the frame structure-keyword template by more than or equal to 90% of the data bits, the frame structure is matched, and the parsed value of the actual keyword is obtained by the corresponding keyword position in the frame structure-keyword template;

[0029] If the frame structure analysis result matches the frame structure of the frame structure-keyword template by more than or equal to 50% and less than 90 bits, determine the frame structure in the frame structure-keyword template that is most similar to the frame structure analysis result, and obtain the estimated value of the actual keyword based on the most similar frame structure and the frame structure-keyword template;

[0030] If the frame structure analysis result matches the frame structure of the frame structure-keyword template by less than 50% of the data bits, the frame structure corresponding to the frame structure analysis result is used as a new sample for generating a new frame structure-keyword template.

[0031] A computer-readable storage medium stores a computer program / instruction, which implements the steps of any of the above methods when executed by a processor.

[0032] A computer program product comprises a computer program / instruction, which implements the steps of any of the above methods when executed by a processor.

[0033] In summary, this application at least includes the following beneficial technical effects:

[0034] Aiming at wireless communication signals, a protocol reverse parsing method consisting of two steps, frame structure analysis and keyword analysis, was constructed. Starting from blind estimation, the method made full use of prior information to realize the parsing of the entire frame content. A variable + fixed double sliding window search mode was proposed to ensure the effectiveness of blind search. A template induction-matching-new keyword analysis logic was proposed to improve the effectiveness of keyword analysis in the presence of bit error rate.

[0035] The designed protocol reverse parsing method for wireless communication signals is applicable to wireless communication equipment such as satellite communication systems, Internet of Things systems, and unmanned communication terminals. It mainly identifies parameters of communication protocols based on data streams without or with little prior information based on physical layer and link layer demodulation. It realizes fast, accurate, and effective estimation for a variety of frame structures and complex and changeable keywords, especially protocol parsing in the absence of or with little prior information. It can be used for consistency, integrity, and availability testing and analysis of wireless communication collaboration, intrusion detection and signal identification, fuzzy testing, protocol vulnerability mining, and security analysis, and has important theoretical value and practical significance. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 The present invention is an overall flow chart of a protocol reverse analysis method for wireless communication signals. DETAILED DESCRIPTION

[0037] In order to make the objectives, technical solutions and advantages of the present invention more clear, the embodiments disclosed in the present invention will be further described in detail below with reference to the accompanying drawings.

[0038] The present application embodiment discloses a protocol reverse parsing method for wireless communication signals, such as Figure 1 As shown, including:

[0039] (1) Frame structure analysis

[0040] 1) Variable sliding window coarse search: for the data stream itself, use multiple sliding windows of different widths to intercept the data stream and perform correlation operations (specifically, convolution correlation operations) on the data stream itself, and determine the minimum width of the sliding window that includes the entire frame length based on the normalized height of the correlation peak;

[0041] Specifically, S11, firstly, a sliding window of a first width is used to slide and intercept the data stream, and a correlation operation is performed with the data stream itself to obtain a first correlation peak spectrum; S12, then the width of the sliding window is increased, a second width is greater than the first width, a sliding window of the second width is used to slide and intercept the data stream, and a correlation operation is performed with the data stream itself to obtain a second correlation peak spectrum; S13, the above step S12 is continued to be repeated to obtain a third correlation peak spectrum...a series of Ith correlation peaks; S14, as the width of the sliding window increases, the heights of the obtained series of correlation peaks gradually increase, until for a sliding window of the mth width and a sliding window of the m+1th width, m and m+1 are both ∈ [1, I], the height of the corresponding m+1th correlation peak spectrum ≤ the height of the mth correlation peak spectrum, at this time, the width of the sliding window of the mth width is used as the minimum width of the sliding window containing the entire frame length;

[0042] 2) Fixed sliding window search, taking into account the expansion window coefficient, which is an empirical value, usually 1-1.5. The fixed sliding window is obtained by using the determined minimum sliding window width * expansion window coefficient, and sliding correlation operation is performed on the data stream to obtain a series of correlation peaks. The two highest and repeated correlation peaks in a series of correlation peaks are the frame headers of two consecutive frames or the frame tails of two consecutive frames. The frame header and frame tail are determined by the length corresponding to the position interval of the two highest and repeated correlation peaks in a series of correlation peaks; the data stream is segmented according to the frame header and frame tail;

[0043] 3) Frame type confirmation: by checking whether the intervals between a series of correlation peaks obtained by fine search of a fixed sliding window are uniform, it is determined whether the frame type is fixed length or variable length;

[0044] 4) Synchronous word length estimation: statistics are collected on the data of each frame after segmentation. The synchronization word in the frame header has a fixed length, and some fixed fields in the synchronization word are the same, while the variable fields have a fixed length but have some similar contents. The part with the highest frequency of the same bits is taken as the fixed field, and the part connected to the fixed field with a higher frequency of the same bits is taken as the length of the variable field. The length of the variable field plus the length of the fixed field is taken as the synchronization word length.

[0045] (2) Keyword analysis

[0046] 1) Template induction: Based on prior knowledge (i.e., the representation of each keyword in the public frame structure), several frame structures—keyword templates are formed;

[0047] 2) Frame structure matching, match the frame structure analysis results (the frame structure analysis results include the frame header, frame tail, synchronization word length, and frame type obtained in the above steps) with the frame structure-keyword template. If the frame structure matches (taking into account the bit error rate, data greater than or equal to 90% of the bits can be matched), the parsed value of the actual keyword is obtained one by one according to the keyword position in the frame structure-keyword template; if most of the frame structures match (greater than or equal to 50% and less than 90 bits of data can be matched), the estimated value of the actual keyword is obtained according to the most similar frame structure-keyword template; if a small part of the frame structure matches (less than 50% of the bits of data can be matched), it is used as a new sample for the generation of a new frame structure-keyword template. (The specific means of matching can adopt various existing intelligent and non-intelligent classification methods)

[0048] 3) New templates are added, and new samples are matched and analyzed in combination with intelligence information. If there is intelligence information that can clearly identify the frame structure and keywords, they are included in the new templates; otherwise, they are placed in the backup information library and wait for new intelligence information to match.

[0049] The contents not described in detail in this application specification belong to the common knowledge of those skilled in the art.

[0050] The present application is described in detail above in conjunction with specific implementation methods and exemplary examples, but these descriptions cannot be understood as limiting the present application. Those skilled in the art understand that, without departing from the spirit and scope of the present application, a variety of equivalent replacements, modifications or improvements can be made to the technical solution of the present application and its implementation methods, all of which fall within the scope of the present application. The scope of protection of the present application shall be subject to the attached claims.

Claims

1. A protocol reverse parsing method, characterized in that: include: S1: Use variable sliding window rough search to determine the minimum sliding window width that includes the entire frame length; S2: Determine the fixed sliding window width according to the minimum sliding window width determined by S1, use the fixed sliding window fine search to determine the frame header and frame tail; and divide the data stream according to the frame header and frame tail; S3: According to the result of the fixed sliding window refined search, confirm whether the frame type is fixed length or variable length; S4: Count the data of each frame divided by S2 to determine the length of the synchronization word; S5: forming a frame structure based on prior knowledge - keyword template; S6: The frame structure analysis result includes the frame header, frame tail, synchronization word length and frame type. The frame structure analysis result is matched with the frame structure-keyword template to obtain the parsed value, inferred value of the actual keyword or obtain a new sample.

2. A protocol reverse parsing method according to claim 1, characterized in that: In S1, a variable sliding window rough search is used to determine the minimum width of the sliding window that includes the entire frame length, including: S11, slidingly intercepting the data stream with a sliding window of a first width, and performing a correlation operation with the data stream itself to obtain a first correlation peak spectrum; S12, increasing the width of the sliding window, wherein the second width is greater than the first width, slidingly intercepting the data stream with the sliding window of the second width, and performing a correlation operation with the data stream itself to obtain a second correlation peak spectrum; S13, continue to repeat the above step S12 to obtain the third correlation peak spectrum... a series of Ith correlation peaks, where I is a positive integer; S14. As the width of the sliding window increases, the heights of the obtained series of correlation peaks gradually increase until, for the sliding window of the mth width and the sliding window of the m+1th width, m and m+1 are both ∈ [1, I], and the height of the corresponding m+1th correlation peak spectrum is ≤ the height of the mth correlation peak spectrum. At this time, the width of the sliding window of the mth width is used as the minimum width of the sliding window that contains the entire frame length.

3. A protocol reverse parsing method according to claim 1, characterized in that: In S2, according to the minimum sliding window width determined in S1, a fixed sliding window width is determined, and a fixed sliding window fine search is used to determine the frame head and the frame tail, including: Fixed sliding window width = sliding window minimum width × expansion window coefficient; The fixed sliding window is made to slide to slide and intercept the data stream, and a correlation operation is performed with the data stream itself to obtain a correlation peak spectrum. The two highest and repeated correlation peaks in the correlation peak spectrum are the frame headers of two consecutive frames or the frame tails of two consecutive frames. The frame header and the frame tail are determined by the length corresponding to the position interval of the two highest and repeated correlation peaks in the correlation peak spectrum.

4. A protocol reverse parsing method according to claim 3, characterized in that: The expansion window coefficient is 1-1.

5.

5. A protocol reverse parsing method according to claim 1, characterized in that: In the S4, the divided frame data are counted to determine the synchronization word length, including: the highest frequency of the same part in each frame data is taken as the fixed field; the part connected to the fixed field, the part with a higher frequency of the same bit is the length of the variable field; the length of the variable field plus the length of the fixed field is taken as the synchronization word length.

6. A protocol reverse parsing method according to claim 1, characterized in that: In S6, the frame structure analysis result is matched with the frame structure-keyword template to obtain the parsed value, estimated value or new sample of the actual keyword, including: If the frame structure analysis result matches the frame structure of the frame structure-keyword template by more than or equal to 90% of the data bits, the frame structure is matched, and the parsed value of the actual keyword is obtained by the corresponding keyword position in the frame structure-keyword template; If the frame structure analysis result matches the frame structure of the frame structure-keyword template by more than or equal to 50% and less than 90 bits, determine the frame structure in the frame structure-keyword template that is most similar to the frame structure analysis result, and obtain the estimated value of the actual keyword based on the most similar frame structure and the frame structure-keyword template; If the frame structure analysis result matches the frame structure of the frame structure-keyword template by less than 50% of the data bits, the frame structure corresponding to the frame structure analysis result is used as a new sample for generating a new frame structure-keyword template.

7. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of any method described in claims 1-6 are implemented.

8. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of any method described in claims 1-6 are implemented.

Images