Protocol reverse resolution method, computer readable storage medium and program product

Abstract

A protocol reverse engineering method, computer-readable storage medium, and program product, relating to the field of information warfare, includes: employing a variable sliding window coarse search to determine the minimum width of the sliding window containing the entire frame length; determining a fixed sliding window width based on the minimum sliding window width, and employing a fixed sliding window fine search to determine the frame header and frame trailer; segmenting the data stream based on the frame header and frame trailer; confirming whether the frame type is fixed-length or variable-length based on the results of the fixed sliding window fine search; statistically analyzing the segmented frame data to determine the synchronization word length; forming a frame structure-keyword template based on prior knowledge; the frame structure analysis results include the frame header, frame trailer, synchronization word length, and frame type; matching the frame structure analysis results with the frame structure-keyword template to obtain the parsed value, inferred value, or new sample of the actual keyword. Based on physical layer and link layer demodulation, parameter identification of the communication protocol is performed on the data stream under conditions of no or little prior information.

Description

Technical Field

[0001] This invention relates to a protocol reverse analysis method for wireless communication signals, a computer-readable storage medium, and a program product, belonging to the fields of wireless communication and information warfare. Background Technology

[0002] With the rapid development of technologies such as communication and artificial intelligence, there are many types of wireless communication protocols. Accurately identifying the parameters of communication protocols based on the identification of signal-level parameters such as the physical layer and link layer of communication signals, especially when prior information is missing or limited, can be used for protocol parsing. This can be applied to the consistency, integrity and availability testing and analysis of wireless communication collaboration, intrusion detection and signal recognition, fuzz testing, protocol vulnerability mining and security analysis, etc., and has important theoretical value and practical significance.

[0003] Regarding protocol message format extraction, the main focus is on describing the value range and meaning of different fields in the protocol message. 1) Message format analysis: In 2004, Beddoe's Protocol Information Project (PI) applied Multiple Sequence Alignment (MSA) technology from biology to network protocol parsing. Subsequently, ScriptGen, Netzob, Li Weiming's automated fuzz testing, and Prodecoder all borrowed this technology. 2) Protocol keyword extraction: Antunes treats the message format as a regular expression language and extracts keywords based on partial order alignment algorithms; Luo et al. obtain protocol keywords by analyzing word frequency; Vertas uses statistical algorithms to analyze message formats; Biprominer uses variable-length pattern recognition methods for extraction, etc. 3) Protocol Domain Segmentation: Shevertalov proposed using the length of the Longest Common Subsequence (LCS) as a feature for clustering in PEXT protocol reverse engineering to classify different message types; Cui et al. proposed dividing subclasses by marking text and binary fields in the protocol and classifying them according to cluster values. 4) Semantic Analysis: Currently, this is mainly implemented based on statistical methods and natural preprocessing methods, including message format reverse analysis methods based on content distribution characteristics proposed by Discoverer, Prodecoder, ASAP, and Trifilo.

[0004] In protocol behavior specification mining, the main focus is on describing the message processing process of protocol subjects. Currently, this is primarily described using a Finite State Machine (FSM) model, specifically including passive inference algorithms and active inference algorithms. Passive analysis algorithms for protocol state machine analysis include the BFS algorithm proposed by Reverx and Trifilo, and the ECGI-based inference algorithm proposed by ScriptGen and Xiao Mingming. Active learning-based state machine inference algorithms have shown good application in protocol reverse engineering methods proposed by Netzob and Cho. Summary of the Invention

[0005] The technical problem addressed in this application is to overcome the shortcomings of existing technologies and provide a method for reverse parsing protocols for wireless communication signals. This method is applicable to wireless communication devices such as satellite communication systems, IoT systems, and unmanned communication terminals. It primarily identifies parameters of communication protocols based on physical and link layer demodulation, focusing on the data stream under conditions of little or no prior information. This is mainly achieved through two major steps: frame structure analysis and frame keyword analysis.

[0006] The specific technical problems to be solved are as follows:

[0007] (1) For a variety of frame structures, a method of coarse search with variable sliding window + fine search with fixed sliding window is used to realize blind recognition of various fixed-length and variable-length frame structures, thus solving the problem of fast recognition of various frame structures under the condition of insufficient prior information.

[0008] (2) For complex and ever-changing keywords, the entire keyword analysis is completed by using template induction, template matching and template addition, which is fully compatible with existing classification methods and realizes the generation of accurate values ​​and inferred values.

[0009] The technical solution provided in this application is as follows:

[0010] A method for reverse engineering protocols for wireless communication signals, comprising:

[0011] S1: Use a variable sliding window coarse search to determine the minimum width of the sliding window that includes the entire frame length;

[0012] S2: Based on the minimum width of the sliding window determined in S1, determine the fixed sliding window width, use the fixed sliding window for fine search, determine the frame header and frame tail; and segment the data stream according to the frame header and frame tail.

[0013] S3: Based on the results of the fixed sliding window fine search, confirm whether the frame type is fixed length or variable length;

[0014] S4: Statistically analyze the segmented frame data to determine the synchronization word length;

[0015] S5: Form a frame structure—keyword template—based on prior knowledge;

[0016] S6: The frame structure analysis results include the frame header, frame tail, synchronization word length, and frame type. The frame structure analysis results are matched with the frame structure-keyword template to obtain the parsed value, inferred value, or new sample of the actual keyword.

[0017] In step S1, a coarse search using a variable sliding window is employed to determine the minimum width of the sliding window that includes the entire frame length, including:

[0018] S11. Use a sliding window of the first width to capture the data stream and perform correlation operations with the data stream itself to obtain the first correlation peak spectrum;

[0019] S12. Increase the width of the sliding window, the second width is greater than the first width, use the sliding window of the second width to slide and capture the data stream, and perform correlation calculations with the data stream itself to obtain the second correlation peak spectrum;

[0020] S13. Continue to repeat step S12 above to obtain the third correlation peak spectrum... a series of I-th correlation peaks, where I is a positive integer;

[0021] S14. As the width of the sliding window increases, the height of the series of related peaks gradually increases until for the sliding window with width m and the sliding window with width m+1, m and m+1 are both ∈ [1, I], the height of the corresponding (m+1)th related peak spectrum is ≤ the height of the mth related peak spectrum. At this time, the width of the sliding window with width m is taken as the minimum width of the sliding window that includes the entire frame length.

[0022] In step S2, based on the minimum width of the sliding window determined in S1, a fixed sliding window width is determined. A precise search using the fixed sliding window is then performed to determine the frame header and frame tail, including:

[0023] Fixed sliding window width = minimum sliding window width × expansion window coefficient;

[0024] The fixed sliding window is used to slide and capture the data stream, and correlation operations are performed with the data stream itself to obtain the correlation peak spectrum. The two highest and repeated correlation peaks in the correlation peak spectrum are the frame headers or frame tails of two consecutive frames. The frame headers and frame tails are determined by the length corresponding to the positional interval of the two highest and repeated correlation peaks in the correlation peak spectrum.

[0025] The expansion window coefficient is 1-1.5.

[0026] In step S4, the segmented frame data is statistically analyzed to determine the synchronization word length, including: the part with the highest frequency of the same part in each frame data is taken as the fixed field; the part with the higher frequency of the same bit in the part connected to the fixed field is the length of the variable field; the length of the variable field plus the length of the fixed field is the synchronization word length.

[0027] In step S6, the frame structure analysis results are matched with the frame structure-keyword template to obtain the parsed value, inferred value, or new sample of the actual keyword, including:

[0028] If the frame structure analysis result matches the frame structure of the frame structure-keyword template by more than 90% of the data, then the frame structure is matched, and the parsed value of the actual keyword is obtained from the corresponding keyword position in the frame structure-keyword template.

[0029] If the frame structure analysis result matches the frame structure of the frame structure-keyword template with more than or equal to 50% and less than 90 bits of data, determine the frame structure in the frame structure-keyword template that is most similar to the frame structure analysis result, and obtain the predicted value of the actual keyword based on the most similar frame structure and the frame structure-keyword template.

[0030] If the frame structure analysis result matches less than 50% of the data in the frame structure of the frame structure-keyword template, the frame structure corresponding to the frame structure analysis result is used as a new sample for generating a new frame structure-keyword template.

[0031] A computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, implement the steps of any of the methods described above.

[0032] A computer program product includes a computer program / instructions that, when executed by a processor, implement the steps of any of the methods described above.

[0033] In summary, this application includes at least the following beneficial technical effects:

[0034] For wireless communication signals, a protocol inverse parsing method consisting of two steps, frame structure analysis and keyword analysis, is constructed. Starting from blind estimation, it makes full use of prior information to realize the parsing of the entire frame content. A variable + fixed dual sliding window search mode is proposed to ensure the effectiveness of blind search. A keyword analysis logic of template induction-matching-addition is proposed to improve the effectiveness of keyword analysis under the condition of bit error rate.

[0035] The designed protocol reverse parsing method for wireless communication signals is applicable to wireless communication devices such as satellite communication systems, IoT systems, and unmanned communication terminals. It primarily performs parameter identification of communication protocols based on physical and link layer demodulation, targeting the data stream under conditions of little or no prior information. It achieves fast, accurate, and effective estimation for diverse frame structures and complex, ever-changing keywords, particularly excelling in protocol parsing under conditions of missing or limited prior information. This method can be used for consistency, integrity, and availability testing and analysis of wireless communication collaboration, intrusion detection and signal recognition, fuzz testing, protocol vulnerability discovery, and security analysis, possessing significant theoretical and practical value. Attached Figure Description

[0036] Figure 1 This is a flowchart illustrating the overall process of a protocol reverse analysis method for wireless communication signals. Detailed Implementation

[0037] To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments disclosed in the present invention will be described in further detail below with reference to the accompanying drawings.

[0038] This application discloses a method for reverse engineering protocols for wireless communication signals, such as... Figure 1 As shown, it includes:

[0039] (1) Frame structure analysis

[0040] 1) Variable sliding window coarse search: For the data stream itself, use multiple sliding windows of different widths to extract the data stream and the data stream itself to perform correlation operations (specifically, the correlation operation of convolution). Determine the minimum width of the sliding window that includes the entire frame length based on the normalized height of the correlation peak.

[0041] Specifically, the steps include: S11, firstly, using a sliding window of the first width to capture the data stream and performing correlation operations with the data stream itself to obtain the first correlation peak spectrum; S12, then increasing the width of the sliding window, making the second width greater than the first width, using a sliding window of the second width to capture the data stream and performing correlation operations with the data stream itself to obtain the second correlation peak spectrum; S13, continuing to repeat the above step S12 to obtain the third correlation peak spectrum... a series of I-th correlation peaks; S14, as the width of the sliding window increases, the height of the series of correlation peaks gradually increases until for a sliding window of the m-th width and a sliding window of the m+1-th width, where m and m+1 are both ∈ [1, I], the height of the corresponding m+1-th correlation peak spectrum is ≤ the height of the m-th correlation peak spectrum. At this point, the width of the m-th width sliding window is used as the minimum width of the sliding window that includes the entire frame length.

[0042] 2) Fixed sliding window fine search: Consider the expansion window coefficient, which is an empirical value, usually 1-1.5. The fixed sliding window is obtained by multiplying the determined minimum width of the sliding window by the expansion window coefficient. Sliding correlation operation is performed on the data stream to obtain a series of correlation peaks. The two highest and repeated correlation peaks in the series of correlation peaks are the frame headers or frame tails of two consecutive frames. The frame headers and frame tails are determined by the length corresponding to the positional interval of the two highest and repeated correlation peaks in the series of correlation peaks. The data stream is segmented according to the frame headers and frame tails.

[0043] 3) Frame type confirmation: Determine whether the frame type is fixed length or variable length by checking whether the intervals between a series of related peaks obtained by the fixed sliding window search are uniform.

[0044] 4) Synchronization word length estimation: Statistically analyze the segmented frame data. Utilize the characteristics that the synchronization word length in the frame header is fixed, and that some fixed fields in the synchronization word are the same, while the variable fields have fixed lengths but some content similarities. The field with the highest frequency of the same part is taken as the fixed field. In the part connected to the fixed field, the part with the same bit that appears more frequently is the length of the variable field. The length of the variable field plus the length of the fixed field is taken as the synchronization word length.

[0045] (2) Keyword Analysis

[0046] 1) Template summarization: Based on prior knowledge (i.e., the representation of each keyword in the public frame structure), several frame structure-keyword templates are formed;

[0047] 2) Frame structure matching: The frame structure analysis results (including the frame header, frame trailer, synchronization word length, and frame type obtained in the previous steps) are matched with the frame structure-keyword template. If the frame structure matches (considering the bit error rate, ≥90% of the data can match), the parsed value of the actual keyword is obtained one by one according to the keyword position in the frame structure-keyword template. If most of the frame structure matches (≥50% and <90 bits of data can match), the predicted value of the actual keyword is obtained according to the most similar frame structure-keyword template. If a small portion of the frame structure matches (<50% of the data can match), it is used as a new sample for generating a new frame structure-keyword template. (The specific matching method can adopt various existing intelligent and non-intelligent classification methods.)

[0048] 3) New templates are added, and new samples are matched and analyzed in conjunction with intelligence information. If there is indeed intelligence information that can clearly identify the frame structure and keywords, they are included in the new template; otherwise, they are placed in the backup information database to wait for new intelligence information to match.

[0049] The contents not described in detail in this application specification are common knowledge to those skilled in the art.

[0050] The present application has been described in detail above with reference to specific embodiments and exemplary examples; however, these descriptions should not be construed as limiting the present application. Those skilled in the art will understand that various equivalent substitutions, modifications, or improvements can be made to the technical solutions and implementation methods of the present application without departing from the spirit and scope of the present application, and all such modifications and improvements fall within the scope of the present application. The scope of protection of the present application is determined by the appended claims.

Claims

1. A protocol reverse parsing method, characterized in that, Used for processing binary bitstream data in wireless communication protocols, including: S1: Use a variable sliding window coarse search to determine the minimum width of the sliding window that includes the entire frame length; S2: Based on the minimum width of the sliding window determined in S1, determine the fixed sliding window width, use the fixed sliding window for fine search, determine the frame header and frame tail; and segment the data stream according to the frame header and frame tail. S3: Based on the results of the fixed sliding window fine search, confirm whether the frame type is fixed length or variable length; S4: Statistically analyze the data of each frame segmented in S2 to determine the synchronization word length; S5: Form a frame structure—keyword template—based on prior knowledge; S6: The frame structure analysis results include the frame header, frame tail, synchronization word length and frame type. The frame structure analysis results are matched with the frame structure-keyword template to obtain the parsed value, inferred value or new sample of the actual keyword. In step S1, a coarse search using a variable sliding window is employed to determine the minimum width of the sliding window that includes the entire frame length, including: S11. Use a sliding window of the first width to capture the data stream and perform correlation operations with the data stream itself to obtain the first correlation peak spectrum; S12. Increase the width of the sliding window, the second width is greater than the first width, use the sliding window of the second width to slide and capture the data stream, and perform correlation calculations with the data stream itself to obtain the second correlation peak spectrum; S13. Continue to repeat step S12 above to obtain the third correlation peak spectrum... a series of I-th correlation peaks, where I is a positive integer; S14. As the width of the sliding window increases, the height of a series of related peaks gradually increases until for the sliding window with the width of m and the sliding window with the width of m+1, m and m+1 are both ∈ [1, I], the height of the corresponding (m+1)th related peak spectrum is ≤ the height of the mth related peak spectrum. At this time, the width of the sliding window with the width of m is taken as the minimum width of the sliding window that includes the entire frame length. In step S2, based on the minimum width of the sliding window determined in S1, a fixed sliding window width is determined. A precise search using the fixed sliding window is then performed to determine the frame header and frame tail, including: Fixed sliding window width = minimum sliding window width × expansion window coefficient; The fixed sliding window is slid to capture the data stream and perform correlation operations with the data stream itself to obtain the correlation peak spectrum. The two highest and repeated correlation peaks in the correlation peak spectrum are the frame header or frame tail of two consecutive frames. The frame header and frame tail are determined by the length corresponding to the position interval of the two highest and repeated correlation peaks in the correlation peak spectrum. The expansion window coefficient is 1-1.5; In step S4, the segmented frame data is statistically analyzed to determine the synchronization word length, including: the part with the highest frequency of the same part in each frame data is taken as the fixed field; the part with the higher frequency of the same bit in the part connected to the fixed field is the length of the variable field; the length of the variable field plus the length of the fixed field is the synchronization word length. In step S6, the frame structure analysis results are matched with the frame structure-keyword template to obtain the parsed value, inferred value, or new sample of the actual keyword, including: If the frame structure analysis result matches the frame structure of the frame structure-keyword template by more than 90% of the data bits, then the frame structure is matched, and the parsed value of the actual keyword is obtained from the corresponding keyword position in the frame structure-keyword template. If the frame structure analysis result matches the frame structure of the frame structure-keyword template with more than 50% but less than 90% of the data, determine the frame structure in the frame structure-keyword template that is most similar to the frame structure analysis result. Based on the most similar frame structure and the frame structure-keyword template, obtain the predicted value of the actual keyword. If the frame structure analysis result matches less than 50% of the frame structure of the frame structure-keyword template, the frame structure corresponding to the frame structure analysis result will be used as a new sample for generating a new frame structure-keyword template.

2. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method of claim 1.

3. A computer program product, comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method of claim 1.

Images