Protocol analysis method and device for ELF file

Abstract

The invention discloses a protocol analysis method and device for an ELF file, and belongs to the technical field of the Internet of Things. The protocol analysis method of the ELF file comprises the following steps: performing first reverse analysis on the ELF file to obtain file information; based on the trained deep semantic learning model, performing second reverse analysis on the ELF file according to the file information to obtain protocol information; based on a deep semantic learning model, determining protocol structure data according to the protocol information and the file information; performing classification processing on the protocol structure data to obtain a classification processing result; and outputting protocol analysis data according to a classification processing result.

Description

Technical Field

[0001] This application belongs to the technical field of the Internet of Things, and particularly relates to a method and device for parsing the protocol of an ELF file. Background Art

[0002] With the in-depth development of the Internet of Things, embedded terminals often use private communication protocols for data interaction. Since these private communication protocols are not publicly available, device security analysis faces challenges. The Executable and Linkable Format (ELF) file, as the core carrier of device firmware, its communication protocol is the entry point for parsing device behavior and identifying potential risks. At present, the ELF protocol reverse parsing technology mainly includes static analysis technology, dynamic analysis technology, and hybrid analysis technology.

[0003] Among them, the static analysis technology uses disassembly tools to extract the control flow graph, data dependency relationship, and function call chain of the file; the dynamic analysis technology uses symbolic execution (a program analysis technology that explores all possible execution paths of a program by using symbolic values as inputs instead of specific numerical values), network traffic Hook (in computer programming, it is a technology for intercepting the normal data flow between software components, and network traffic Hook is used to intercept network traffic-related operations), and device simulation and other means to capture the jump logic and encryption algorithm call process during the protocol operation; the hybrid analysis technology combines static disassembly and dynamic Fuzzing (fuzzy testing, a software testing technology that discovers software vulnerabilities by providing unexpected inputs to the target system and monitoring abnormal results), and constructs abnormal inputs to trigger the protocol branch logic to achieve the reverse parsing of complex protocols.

[0004] However, although the above technologies have played an important role and provided certain support in protocol reverse analysis, there are still defects in the device ELF protocol parsing: strong manual dependence, low efficiency, requiring manual intervention by security experts, and long reverse analysis time; when reverse analyzing variant protocols, it is necessary to manually verify the semantics of each field item by item, which is prone to missing nested encryption logic and has insufficient semantic modeling accuracy. In this way, both the efficiency and accuracy of ELF file protocol reverse parsing are relatively low. Summary of the Invention

[0005] The purpose of the embodiments of this application is to provide a method and device for parsing the protocol of an ELF file, which can improve the efficiency and accuracy of ELF file protocol reverse parsing.

[0006] In a first aspect, an embodiment of the present application provides a method for protocol parsing of an ELF file. The method includes: performing a first reverse analysis on the ELF file to obtain file information; based on a trained deep semantic learning model, performing a second reverse analysis on the ELF file according to the file information to obtain protocol information; based on the deep semantic learning model, determining protocol structure data according to the protocol information and the file information; performing a classification process on the protocol structure data to obtain a classification result; and outputting protocol parsing data according to the classification result.

[0007] In a second aspect, an embodiment of the present application provides a device for protocol parsing of an ELF file. The device includes: a processing unit configured to perform a first reverse analysis on the ELF file to obtain file information; the processing unit is further configured to perform a second reverse analysis on the ELF file according to the file information based on a trained deep semantic learning model to obtain protocol information; the processing unit is further configured to determine protocol structure data according to the protocol information and the file information based on the deep semantic learning model; the processing unit is further configured to perform a classification process on the protocol structure data to obtain a classification result; and an output unit configured to output protocol parsing data according to the classification result.

[0008] In a third aspect, an embodiment of the present application provides an electronic device, which includes a processor and a memory. The memory stores a program or instruction that can run on the processor. When the program or instruction is executed by the processor, the steps of the method for protocol parsing of an ELF file as in the first aspect are implemented.

[0009] In a fourth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method for protocol parsing of an ELF file as in the first aspect are implemented.

[0010] In a fifth aspect, an embodiment of the present application provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor, and the processor is configured to run a program or instruction to implement the steps of the method for protocol parsing of an ELF file as in the first aspect.

[0011] In a sixth aspect, an embodiment of the present application provides a computer program product, which is stored in a storage medium. The program product is executed by at least one processor to implement the steps of the method for protocol parsing of an ELF file as in the first aspect.

[0012] In the protocol parsing method of the ELF file provided by the embodiment of the present application, a first reverse analysis is performed on the ELF file to obtain file information; based on the trained deep semantic learning model, a second reverse analysis is performed on the ELF file according to the file information to obtain protocol information; based on the deep semantic learning model, according to the protocol information and the file information, protocol structure data is determined; the protocol structure data is classified to obtain a classification result; according to the classification result, protocol parsing data is output. Through the above protocol parsing method of the ELF file, file information is obtained through the first reverse analysis, and then the protocol information is obtained through the second reverse analysis based on the deep semantic learning model. Furthermore, based on the deep semantic learning model, according to the protocol information and the file information, protocol structure data is determined, and the protocol structure data is classified and then protocol parsing data is output. In this way, by combining the deep semantic learning model and the automated reverse technology, the accurate parsing of the ELF file protocol is realized, the protocol misjudgment rate is reduced, the accuracy of extracting protocol information is improved, redundant operations are avoided, the parsing time is reduced, and the efficiency of ELF file protocol parsing is improved. Brief Description of the Drawings

[0013] Figure 1 It is a schematic flowchart of the protocol parsing method of the ELF file provided by the embodiment of the present application;

[0014] Figure 2 It is a principle block diagram of the protocol parsing method of the ELF file provided by the embodiment of the present application;

[0015] Figure 3 It is a structural block diagram of the protocol parsing device of the ELF file provided by the embodiment of the present application;

[0016] Figure 4 It is a structural block diagram of the electronic device provided by the embodiment of the present application;

[0017] Figure 5 It is a schematic hardware structure diagram of the electronic device provided by the embodiment of the present application. Detailed Description of the Embodiments

[0018] Next, the technical solutions in the embodiments of the present application will be clearly described in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are some, but not all, of the embodiments of the present application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present application belong to the scope of protection of the present application.

[0019] The terms "first", "second", etc. in the description and claims of this application are used to distinguish similar objects, rather than to describe a specific order or sequence. It should be understood that such terms can be interchanged under appropriate circumstances so that the embodiments of this application can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally of one category, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the description and claims means at least one of the connected objects, and the character " / ", generally represents an "or" relationship between the associated objects before and after.

[0020] The following will combine the accompanying drawings and, through specific embodiments and their application scenarios, provide a detailed description of the protocol parsing method for ELF files provided by the embodiments of this application.

[0021] As Figure 1 shown, the embodiments of this application provide a protocol parsing method for ELF files, and this method may include the following S102 to S110:

[0022] S102: Perform a first reverse analysis on the ELF file to obtain file information.

[0023] The protocol parsing method for ELF files proposed by the embodiments of this application is executed by an electronic device, and this electronic device can specifically be an intelligent electronic device such as a smart phone, a tablet computer, a notebook computer, and a smart watch, and no specific limitation is made here.

[0024] Among them, the first reverse analysis is a preliminary reverse analysis of the ELF file.

[0025] Furthermore, the first reverse analysis may specifically include operations such as file loading, partition identification, function identification and analysis, and determination of data interaction relationships.

[0026] Furthermore, the above-mentioned file information may specifically include partition information, function call information, data variable information, logical branch information, loop structure information, and code behavior data of the ELF file, and no specific limitation is made here.

[0027] Specifically, in the protocol parsing method for ELF files provided by the embodiments of this application, a reverse analysis tool is used to load and open the ELF file to be analyzed, and then, through operations such as partition identification, function identification and analysis, and determination of data interaction relationships, a first reverse analysis is performed on the ELF file to obtain file information such as partition information, function call information, data variable information, logical branch information, loop structure information, and code behavior data of the ELF file.

[0028] S104: Based on the trained deep semantic learning model, perform a second reverse analysis on the ELF file according to the file information to obtain protocol information.

[0029] Among them, the above deep semantic learning model can specifically be a large language model (LLM) based on deep semantic learning, and there is no specific limitation here.

[0030] Furthermore, deep semantic learning (DSL) refers to a learning method that semantically models and analyzes the context of language based on deep neural network technology. Through pre-trained models and multi-modal fusion strategies, it solves problems such as long-distance dependencies and ambiguity resolution in traditional semantics.

[0031] Furthermore, the second reverse analysis is a deep reverse analysis of the ELF file.

[0032] Furthermore, the second reverse analysis can specifically include operations such as information input, semantic parsing, and behavior analysis.

[0033] Furthermore, the above protocol information can specifically include protocol code information, protocol data interaction information, protocol processing logic information, and protocol generation logic information of the ELF file.

[0034] Specifically, in the protocol parsing method of the ELF file provided in the embodiments of the present application, after obtaining the file information of the ELF file through a preliminary reverse analysis of the ELF file, based on the trained deep semantic learning model, through operations such as semantic parsing and behavior analysis, perform a second reverse analysis on the ELF file according to the above file information to obtain protocol information such as protocol code information, protocol data interaction information, protocol processing logic information, and protocol generation logic information of the ELF file. In this way, a multi-layer reverse analysis of the ELF file is realized, that is, first obtain the file information through the first reverse analysis, and then perform a second reverse analysis based on the deep semantic learning model to obtain the protocol information. This step-by-step analysis method with the help of the deep semantic learning model can parse the ELF file more accurately than a single analysis method, reduce information misjudgment, and improve the accuracy of protocol information extraction.

[0035] S106: Based on the deep semantic learning model, determine the protocol structure data according to the protocol information and the file information.

[0036] Specifically, in the protocol parsing method of the ELF file provided in the embodiments of the present application, after obtaining the file information and protocol information of the ELF file, based on the deep semantic learning model, deduce the communication protocol structure of the ELF file according to the protocol information and the file information, and determine the protocol structure data of the ELF file.

[0037] Among them, the deep semantic learning model has powerful semantic understanding and pattern recognition capabilities. In the process of determining the protocol structure data based on the deep semantic learning model according to the file information and protocol information, it can mine the potential connections and semantic relationships between data, accurately determine the protocol structure data, thereby improving the accuracy of the overall analysis of the ELF protocol.

[0038] S108: Classify the protocol structure data to obtain the classification result.

[0039] Among them, the classification process is used to classify and organize the output result of the deep semantic learning model, that is, the protocol structure data.

[0040] Furthermore, the classification process may specifically include operations such as protocol analyzer application, feature classification, and data categorization.

[0041] Among them, a protocol analyzer is a tool or system used to monitor, decode, and analyze communication protocols.

[0042] S110: Output the protocol parsing data according to the classification result.

[0043] Specifically, in the protocol parsing method of the ELF file provided in the embodiment of the present application, after inferring the protocol structure data of the ELF file, the protocol structure data is classified to obtain the classification result, and then the protocol parsing data is output according to the classification result to implement the communication protocol parsing of the ELF file. In this way, classifying the protocol structure data and outputting the protocol parsing data, this process-based and structured processing method makes the entire parsing process more organized, avoids redundant operations, reduces the parsing time, and improves the processing efficiency of the ELF file protocol parsing.

[0044] In the protocol parsing method of the ELF file provided in the embodiment of the present application, starting from obtaining the file information, to determining the protocol structure data, then to classification processing and outputting the parsing data, a complete and systematic data processing process is formed. This systematicness ensures the comprehensive and orderly processing of the ELF file from the original data to the final parsing result, realizes the automated reverse parsing of the ELF file, can better handle complex ELF file protocol parsing tasks, and provides a reliable data basis for subsequent applications based on the parsing results, such as software debugging, security detection, etc.

[0045] Among them, Automated Reverse Engineering (ARE) is a process of using script tools and defined rules to replace manual operations and carry out large-scale reverse analysis. It can extract the logic and interaction rules of the target system, improve the efficiency of reverse analysis, and reduce the dependence on experience.

[0046] Furthermore, Protocol Parsing (PP) is a technology for reverse decoding and analyzing the protocols of data transmitted between devices. By means of syntax parsing, field restoration, state machine modeling, etc., it extracts key fields and applies them to scenarios such as traffic auditing and anomaly detection.

[0047] Among them, in the actual application process, when outputting protocol parsing data, specifically, the standardized output of protocol parsing data can be achieved through means such as automated pipeline configuration and data format conversion. Specifically, when outputting protocol parsing data, an automated processing pipeline is configured. The automated processing pipeline is used to standardize the output of protocol parsing data. Then, by using the configured automated processing pipeline, the above classification processing results are converted into a standardized data format, such as JSON (JavaScript Object Notation, a lightweight data exchange format) or XML (Extensible Markup Language) format, and then the standardized protocol parsing data is output.

[0048] In addition, in the actual application process, after outputting the protocol parsing data, a detailed report on the entire parsing process and results can also be generated to provide a basis for subsequent protocol analysis and research.

[0049] The protocol parsing method for ELF files provided by the embodiments of this application performs a first reverse analysis on the ELF file to obtain file information; based on the trained deep semantic learning model, performs a second reverse analysis on the ELF file according to the file information to obtain protocol information; based on the deep semantic learning model, determines protocol structure data according to the protocol information and the file information; performs classification processing on the protocol structure data to obtain a classification processing result; and outputs protocol parsing data according to the classification processing result. Through the above protocol parsing method for ELF files, file information is obtained through the first reverse analysis, and then the second reverse analysis is performed based on the deep semantic learning model to obtain protocol information. Furthermore, based on the deep semantic learning model, protocol structure data is determined according to the protocol information and the file information, and the protocol structure data is classified and processed and then the protocol parsing data is output. In this way, by combining the deep semantic learning model and the automated reverse technology, the accurate parsing of the ELF file protocol is achieved, the protocol misjudgment rate is reduced, the accuracy of protocol information extraction is improved, redundant operations are avoided, the parsing time is reduced, and the efficiency of ELF file protocol parsing is improved.

[0050] In the embodiments of this application, the above S102 may specifically include the following S102a to S102c:

[0051] S102a: Identify partitions in the header information of the ELF file to obtain the partition information of the ELF file.

[0052] Among them, the above partition information may specifically include key partitions such as the code segment, data segment, and symbol table in the header information of the ELF file.

[0053] Specifically, in the ELF file protocol parsing method provided in the embodiments of this application, after successfully loading the ELF file to be parsed, identify partitions in the header information of the ELF file, identify key partitions such as the code segment, data segment, and symbol table in the header information, and obtain the partition information of the ELF file. In this way, identifying partitions in the header information of the ELF file to obtain partition information can clearly define the positions and ranges of different functional areas of the file, such as the code segment and data segment, laying a foundation for accurately analyzing the content of each area later, avoiding confusion of data in different areas, and making the understanding of the overall structure of the file more accurate.

[0054] S102b: Identify the function boundaries of the ELF file to obtain the function call information of the ELF file.

[0055] Specifically, in the ELF file protocol parsing method provided in the embodiments of this application, after successfully loading the ELF file to be parsed, the ELF file will also be identified and analyzed. Use disassembly technology to identify the function boundaries of the ELF file, and analyze the entry, exit, and call relationships of each function to obtain the function call information of the ELF file. In this way, by identifying the function boundaries to obtain the function call information, the call relationships and execution sequences between functions can be clarified, which helps to understand the logical flow of the program. In scenarios such as software debugging and performance optimization, the key functions and call paths can be quickly located, improving the analysis and processing efficiency.

[0056] S102c: Check the interaction relationship between the data segment and the code segment in the partition information to determine the data variable information of the ELF file.

[0057] Specifically, in the ELF file protocol parsing method provided in the embodiments of this application, after successfully loading the ELF file to be parsed, the data interaction relationship of the ELF file will also be determined. By checking whether there is an interaction between the data segment in the partition information of the ELF file and the code segment, trace the data structures and important variables that may be involved in the communication protocol to obtain the data variable information of the ELF file. In this way, by checking the interaction relationship between the data segment and the code segment to determine the data variable information, the flow and usage of data during program operation can be accurately grasped, and it can be known how the code operates on the data, which is of great significance for understanding the program function, troubleshooting data-related errors and security vulnerabilities, etc., and improving the accuracy of understanding the internal data operation mechanism of the program.

[0058] In the above embodiments provided by the present application, the file header information of the ELF file is partitioned and identified to obtain the partition information of the ELF file; the function boundaries of the ELF file are identified to obtain the function call information of the ELF file; the interaction relationship between the data segment and the code segment in the partition information is checked to determine the data variable information of the ELF file. In this way, comprehensive and accurate file information can be obtained, providing high-quality basic data for subsequent steps such as second reverse analysis based on the deep semantic learning model and determining protocol structure data, enabling more accurate analysis based on the file information in the subsequent steps, and thus improving the reliability and effectiveness of the entire ELF file protocol parsing.

[0059] In the embodiment of the present application, before the above S104, the protocol parsing method of the above ELF file may specifically further include the following S112 to S118:

[0060] S112: Obtain the protocol data set of the target protocol.

[0061] Among them, the above target protocol is the communication protocol to be parsed in the ELF file.

[0062] Furthermore, the above protocol data set may specifically include the specification document of the target protocol, network traffic records, etc., and no specific limitation is made here.

[0063] Specifically, in the protocol parsing method of the ELF file provided by the embodiment of the present application, before processing the file information based on the deep semantic learning model, a deep semantic learning model that meets the requirements will be trained. During the process of training the deep semantic learning model, first collect the public data set related to the target protocol, or capture protocol data from actual communications to obtain the protocol data set of the target protocol.

[0064] S114: Convert the protocol text in the protocol data set into structured features to obtain protocol feature data.

[0065] Specifically, in the protocol parsing method of the ELF file provided by the embodiment of the present application, after obtaining the protocol data set of the target protocol, extract features for the protocol instances in the data set, and use natural language processing technology to convert the protocol text in the protocol data set into structured features to extract the features of the protocol instances in the protocol data set, so as to obtain protocol feature data. In this way, by obtaining the protocol data set of the target protocol and converting the protocol text into structured features to obtain protocol feature data, the deep semantic learning model can be exposed to a data form closely related to the target protocol, enabling the model to learn the unique semantic patterns, structural characteristics, etc. of the target protocol, so as to better adapt to the analysis task of the target protocol. Compared with the general model, the pertinence of parsing the target protocol is stronger.

[0066] S116: Pre-train the deep learning model to obtain a general deep semantic learning model.

[0067] Specifically, in the ELF file protocol parsing method provided in the embodiments of the present application, during the process of training the deep semantic learning model, a suitable deep learning model architecture, such as Transformer, will also be selected and pre-trained to obtain a general deep semantic learning model.

[0068] S118: Fine-tune the general deep semantic learning model according to the protocol feature data to obtain a deep semantic learning model.

[0069] Specifically, in the ELF file protocol parsing method provided in the embodiments of the present application, after pre-training to obtain a general deep semantic learning model, transfer learning and fine-tuning processing are performed on the general deep semantic learning model according to the protocol feature data to fine-tune the general deep semantic learning model to the above-mentioned target protocol, improve the recognition and parsing ability of the general deep semantic learning model for the target protocol, and obtain the above-mentioned deep semantic learning model. In this way, the deep learning model is pre-trained first to enable it to have a certain basic semantic understanding ability, and then fine-tuned according to the protocol feature data, which can further optimize for the target protocol on the basis of the existing knowledge of the model, enabling the model to more accurately capture the semantic information and structural rules in the target protocol, and improving the adaptability and accuracy of the model for the target protocol parsing task.

[0070] In the above embodiments provided by the present application, a protocol data set of the target protocol is obtained; the protocol texts in the protocol data set are converted into structured features to obtain protocol feature data; the deep learning model is pre-trained to obtain a general deep semantic learning model; the general deep semantic learning model is fine-tuned according to the protocol feature data to obtain a deep semantic learning model. In this way, the model is specially adapted and trained, can more accurately identify protocol-related elements and the relationships between them, reduce parsing errors, and improve the accuracy and reliability of the ELF file protocol parsing result.

[0071] In the embodiments of the present application, the above S104 may specifically include the following S104a and S104b:

[0072] S104a: Based on the trained deep semantic learning model, perform semantic analysis on the data segment and code segment of the ELF file to obtain protocol code information and protocol data interaction information.

[0073] Specifically, in the ELF file protocol parsing method provided by the embodiments of the present application, after obtaining the file information of the ELF file, the file information such as the code segment and data segment of the ELF file is structurally input into the fine-tuned deep semantic learning model. Then, based on the deep semantic learning model, semantic analysis is performed on the data segment and the code segment to identify potential protocol-related code and data interactions, and the protocol code information and protocol data interaction information of the ELF file are obtained. In this way, by performing semantic analysis on the data segment and code segment of the ELF file based on the trained deep semantic learning model, the protocol code information and protocol data interaction information can be accurately mined, which helps to clearly grasp the operation logic of the code on the data in the program, such as the manifestation of operations such as data reading, modification, and storage at the protocol level, enabling developers or analysts to deeply understand the protocol operation mechanism from a semantic perspective, so as to accurately locate problems and improvement solutions in protocol development, debugging, optimization, etc.

[0074] S104b: Based on the trained deep semantic learning model, analyze the function call information, logical branches, and loop structures of the ELF file to obtain protocol processing logic information and protocol generation logic information.

[0075] Specifically, in the ELF file protocol parsing method provided by the embodiments of the present application, after structurally inputting the file information into the deep semantic learning model, behavioral analysis is also performed on the ELF file based on the file information. By analyzing file information such as the function call information, logical branch information, and loop structure information of the ELF file, possible protocol processing and generation logics are evaluated to obtain the protocol processing logic information and protocol generation logic information of the ELF file. In this way, the deep semantic learning model can insight into the logical relationships in the program execution process, clarify the impact of different function call sequences, logical branch directions, and the operation modes of loop structures on the protocol function implementation, and help understand how the protocol processes inputs and generates outputs according to specific logics, providing strong support for in-depth analysis of protocol function completeness, robustness, etc.

[0076] Based on the trained deep semantic learning model, the above embodiments provided by the present application perform semantic analysis on the data segment and code segment of the ELF file to obtain protocol code information and protocol data interaction information; based on the trained deep semantic learning model, analyze the function call information, logical branches, and loop structures of the ELF file to obtain protocol processing logic information and protocol generation logic information. In this way, based on the powerful semantic understanding ability of the deep semantic learning model, protocol information is obtained from multiple aspects such as code and data interaction, and logical structure, making the parsed protocol information more comprehensive and complete, reducing information omission, providing richer and more accurate basic information for subsequent steps such as determining protocol structure data and classification processing, improving the quality of the entire ELF file protocol parsing, and effectively avoiding misjudgment of protocol information caused by semantic understanding deviation, making the finally obtained protocol parsing data closer to the actual operation of the protocol and enhancing the accuracy of protocol parsing.

[0077] In the embodiment of the present application, the above S106 may specifically include the following S106a and S106b:

[0078] S106a: Identify protocol feature data according to the protocol information.

[0079] Among them, the above protocol feature data may specifically include data such as message headers, field types, and encoding methods.

[0080] Specifically, in the ELF file protocol parsing method provided by the embodiment of the present application, after obtaining the protocol information of the ELF file based on the deep semantic learning model, according to this protocol information, protocol feature recognition is performed on the ELF file to identify the structural features of the communication protocol of the ELF file, such as message headers, field types, and encoding methods, to obtain the protocol feature data of the ELF file. In this way, key elements with representativeness and distinctiveness in the protocol can be mined, avoiding omission of important information or extraction of incorrect features, providing a solid and reliable basis for subsequent determination of protocol structure data, and improving the accuracy of grasping protocol features.

[0081] S106b: Based on the deep semantic learning model, determine protocol structure data according to the protocol feature data and the code behavior data of the ELF file.

[0082] Among them, the above protocol structure data is the detailed data of the communication protocol structure of the ELF file, such as state machine information and exchange order.

[0083] Specifically, in the protocol parsing method of the ELF file provided in the embodiments of the present application, after obtaining the protocol feature data of the ELF file, based on the inference ability of the deep semantic learning model and combined with the code behavior data of the ELF file, the detailed data of the communication protocol structure of the ELF file is deduced to obtain the protocol structure data of the ELF file. In this way, the behavior pattern of the protocol at the code level and the characteristics of the protocol itself can be comprehensively considered, the internal structural relationship of the protocol can be understood comprehensively and deeply, the structural framework of the protocol can be outlined more accurately, the structural misjudgment can be reduced, and the accuracy and reliability of the understanding of the protocol structure can be improved, laying a good foundation for the subsequent classification processing and final parsing of the protocol structure data.

[0084] In the actual application process, after the protocol structure data of the ELF file is deduced, the deduced protocol structure data is also compared and verified with the known protocol standard. Only when the format of the deduced protocol structure data conforms to the known protocol standard, the deduced protocol structure data of the ELF file is confirmed to ensure the accuracy of the deduction of the protocol structure data.

[0085] In the above embodiments provided by the present application, according to the protocol information, the protocol feature data is identified; based on the deep semantic learning model, according to the protocol feature data and the code behavior data of the ELF file, the protocol structure data is determined. In this way, the key elements with representativeness and distinctiveness in the protocol can be mined, the omission of important information or the extraction of wrong features can be avoided, the structural framework of the protocol can be outlined more accurately, the structural misjudgment can be reduced, the accuracy and reliability of the understanding of the protocol structure can be improved, and thus the accuracy rate of the overall ELF protocol parsing can be improved.

[0086] In the embodiments of the present application, the above S108 may specifically include the following S108a to S108c:

[0087] S108a: Use a protocol analyzer to determine the protocol type corresponding to the protocol structure data.

[0088] Among them, the above protocol types include but are not limited to: network protocols, application layer protocols, text protocols, etc., and no specific limitations are made here.

[0089] Specifically, in the protocol parsing method of the ELF file provided in the embodiments of the present application, after obtaining the protocol structure data of the ELF file, the parsing result output by the deep semantic learning model, that is, the protocol structure data, is further classified and refined by a customized protocol analyzer to identify the protocol type corresponding to the protocol structure data. In this way, the protocol can be classified quickly and accurately, which helps analysts quickly understand the category to which the protocol belongs, provides a direction for subsequent targeted analysis, avoids blind analysis when the protocol type is not clear, and improves the analysis efficiency.

[0090] S108b: Classify the protocol fields in the protocol structure data and extract the key fields from the protocol fields.

[0091] Specifically, in the protocol parsing method of the ELF file provided in the embodiment of the present application, after obtaining the protocol structure data of the ELF file, the protocol fields are classified according to the types and functions of the protocol fields in the protocol structure data, and the key fields in the classified protocol fields are extracted, such as fields like identifiers, length information, check codes, etc. In this way, the internal composition of the protocol can be deeply analyzed, which helps to grasp the core elements of the protocol, accurately understand the working principle and data interaction logic of the protocol, and provide more targeted information in scenarios such as protocol development, debugging, and security detection.

[0092] S108c: Determine the classification processing result according to the protocol type and the key fields.

[0093] Specifically, in the protocol parsing method of the ELF file provided in the embodiment of the present application, after classifying and extracting the protocol structure data, the obtained protocol type and key fields are sorted out to obtain the classification processing result.

[0094] In the actual application process, after extracting the key fields in the classified protocol fields, the unextracted protocol fields are also classified for subsequent processing and research.

[0095] In the above embodiments provided by the present application, a protocol analyzer is used to determine the protocol type corresponding to the protocol structure data; the protocol fields in the protocol structure data are classified, and the key fields in the protocol fields are extracted; the classification processing result is determined according to the protocol type and the key fields. In this way, by combining the protocol type information with the key field information, the final classification processing result can be made more comprehensive and accurate, providing a more reliable intermediate result for subsequent output of protocol parsing data, improving the quality and practicality of the entire ELF file protocol parsing, and facilitating analysts to make correct decisions based on accurate results.

[0096] In summary, the embodiments of the present application provide an automated reverse parsing solution for ELF file communication protocols based on deep semantic learning. By combining static analysis and deep learning technologies, efficient parsing and understanding of unknown communication protocols are achieved. Specifically, in the protocol parsing method for ELF files provided in the embodiments of the present application, a deep semantic learning model and automated reverse technology are introduced. By optimizing the pre-trained language model, the dependence on artificial experience in the traditional rule library is broken, and accurate differentiation between protocol fields and business logic is achieved. At the same time, in the scenario of obfuscated code, the recognition of protocol fields is improved from traditional methods, and the automated parsing process improves the parsing efficiency. In this way, accurate recognition and detailed analysis of unknown communication protocols in ELF files are realized, providing strong technical support for fields such as information security, protocol compatibility testing, and vulnerability mining.

[0097] Specifically, in the protocol parsing method for ELF files provided in the embodiments of the present application, as Figure 2 shown, the ELF file is used as a sample and input into the process. The reverse analysis tool IDA (Interactive Disassembler, an interactive disassembly tool) is used to process the ELF file to obtain the reverse data stream. The LLM model is optimized through the protocol data set of the communication protocol. Based on information such as the reverse data stream, the optimized LLM model parses the protocol and outputs the parsed protocol, that is, the protocol structure data. The protocol classifier classifies the parsed protocol output by the LLM model, and finally outputs the protocol parsing result. In this way, by combining the LLM model of deep semantic learning and automated reverse technology, accurate parsing of the ELF communication protocol is achieved, reducing the protocol misjudgment rate, improving the accuracy and adaptability of the protocol reverse parsing solution, and improving the protocol parsing performance and reverse efficiency through process automation, providing strong support for the interoperability and security defense of the Internet of Things.

[0098] In the actual application process, the above protocol parsing method can also be applied to the communication protocols of other closed files, and no specific limitation is made here.

[0099] The protocol parsing method for ELF files provided in the embodiments of the present application may have an execution entity as a protocol parsing device for ELF files. In the embodiments of the present application, taking the protocol parsing device for ELF files to execute the above protocol parsing method for ELF files as an example, the protocol parsing device for ELF files provided in the embodiments of the present application is described.

[0100] As Figure 3 shown, the embodiments of the present application provide a protocol parsing device 200 for ELF files, and the device may include the following processing unit 202 and output unit 204.

[0101] The processing unit 202 is configured to perform a first reverse analysis on the ELF file to obtain file information;

[0102] The processing unit 202 is further configured to perform a second reverse analysis on the ELF file based on the trained deep semantic learning model according to the file information to obtain protocol information;

[0103] The processing unit 202 is further configured to determine protocol structure data based on the deep semantic learning model according to the protocol information and the file information;

[0104] The processing unit 202 is further configured to perform classification processing on the protocol structure data to obtain a classification processing result;

[0105] The output unit 204 is configured to output protocol parsing data according to the classification processing result.

[0106] The protocol parsing apparatus 200 for ELF files provided by the embodiments of the present application performs a first reverse analysis on the ELF file to obtain file information; performs a second reverse analysis on the ELF file based on the trained deep semantic learning model according to the file information to obtain protocol information; determines protocol structure data based on the deep semantic learning model according to the protocol information and the file information; performs classification processing on the protocol structure data to obtain a classification processing result; and outputs protocol parsing data according to the classification processing result. Through the above-mentioned protocol parsing apparatus 200 for ELF files, file information is obtained through the first reverse analysis, and then the protocol information is obtained through the second reverse analysis based on the deep semantic learning model. Furthermore, based on the deep semantic learning model, according to the protocol information and the file information, the protocol structure data is determined, and the protocol structure data is classified and processed and then the protocol parsing data is output. In this way, by combining the deep semantic learning model and the automated reverse technology, the accurate parsing of the ELF file protocol is realized, the protocol misjudgment rate is reduced, the accuracy of extracting protocol information is improved, redundant operations are avoided, the parsing time is reduced, and the efficiency of ELF file protocol parsing is improved.

[0107] In the embodiments of the present application, the processing unit 202 is specifically configured to: identify partitions of the file header information of the ELF file to obtain partition information of the ELF file; identify function boundaries of the ELF file to obtain function call information of the ELF file; and check the interaction relationship between the data segment and the code segment in the partition information to determine the data variable information of the ELF file.

[0108] In the above embodiments provided by the present application, the file header information of the ELF file is partitioned and identified to obtain the partition information of the ELF file; the function boundaries of the ELF file are identified to obtain the function call information of the ELF file; the interaction relationship between the data segment and the code segment in the partition information is checked to determine the data variable information of the ELF file. In this way, comprehensive and accurate file information can be obtained, providing high-quality basic data for subsequent steps such as second reverse analysis based on the deep semantic learning model and determining protocol structure data, enabling more accurate analysis based on the file information in the subsequent steps, and thus improving the reliability and effectiveness of the entire ELF file protocol parsing.

[0109] In the embodiment of the present application, the processing unit 202 is further configured to: obtain a protocol data set of the target protocol; convert the protocol text in the protocol data set into structured features to obtain protocol feature data; pre-train a deep learning model to obtain a general deep semantic learning model; and perform fine-tuning processing on the general deep semantic learning model according to the protocol feature data to obtain a deep semantic learning model.

[0110] In the above embodiments provided by the present application, a protocol data set of the target protocol is obtained; the protocol text in the protocol data set is converted into structured features to obtain protocol feature data; a deep learning model is pre-trained to obtain a general deep semantic learning model; and the general deep semantic learning model is fine-tuned according to the protocol feature data to obtain a deep semantic learning model. In this way, the model is specially adapted and trained to more accurately identify protocol-related elements and the relationships between them, reduce parsing errors, and improve the accuracy and reliability of the ELF file protocol parsing results.

[0111] In the embodiment of the present application, the processing unit 202 is specifically configured to: perform semantic analysis on the data segment and the code segment of the ELF file based on the trained deep semantic learning model to obtain protocol code information and protocol data interaction information; and analyze the function call information, logical branches, and loop structures of the ELF file based on the trained deep semantic learning model to obtain protocol processing logic information and protocol generation logic information.

[0112] In the above embodiments provided by the present application, based on the trained deep semantic learning model, semantic analysis is performed on the data segment and code segment of the ELF file to obtain protocol code information and protocol data interaction information; based on the trained deep semantic learning model, the function call information, logical branches, and loop structures of the ELF file are analyzed to obtain protocol processing logic information and protocol generation logic information. In this way, based on the powerful semantic understanding ability of the deep semantic learning model, protocol information is obtained from multiple aspects such as code and data interaction and logical structure, making the parsed protocol information more comprehensive and complete, reducing information omission, providing richer and more accurate basic information for subsequent steps such as determining protocol structure data and classification processing, improving the quality of the entire ELF file protocol parsing, and effectively avoiding misjudgment of protocol information caused by semantic understanding deviation, making the finally obtained protocol parsing data closer to the actual operation of the protocol and enhancing the accuracy of protocol parsing.

[0113] In the embodiment of the present application, the processing unit 202 is specifically configured to: identify protocol feature data according to the protocol information; based on the deep semantic learning model, determine protocol structure data according to the protocol feature data and the code behavior data of the ELF file.

[0114] In the above embodiments provided by the present application, protocol feature data is identified according to the protocol information; based on the deep semantic learning model, protocol structure data is determined according to the protocol feature data and the code behavior data of the ELF file. In this way, key elements with representativeness and distinctiveness in the protocol can be mined, avoiding omission of important information or extraction of incorrect features, and being able to more accurately outline the structural framework of the protocol, reducing structural misjudgment, and improving the accuracy and reliability of the understanding of the protocol structure, thereby improving the accuracy of the overall ELF protocol parsing.

[0115] In the embodiment of the present application, the processing unit 202 is specifically configured to: use a protocol analyzer to determine the protocol type corresponding to the protocol structure data; classify the protocol fields in the protocol structure data and extract the key fields in the protocol fields; determine the classification processing result according to the protocol type and the key fields.

[0116] In the above embodiments provided by the present application, a protocol analyzer is used to determine the protocol type corresponding to the protocol structure data; the protocol fields in the protocol structure data are classified and the key fields in the protocol fields are extracted; the classification processing result is determined according to the protocol type and the key fields. In this way, by combining the protocol type information with the key field information, the final classification processing result can be made more comprehensive and accurate, providing a more reliable intermediate result for subsequent output of protocol parsing data, improving the quality and practicality of the entire ELF file protocol parsing, and facilitating analysts to make correct decisions based on accurate results.

[0117] The protocol parsing device 200 of the ELF file in the embodiments of the present application may be an electronic device or a component in an electronic device, such as an integrated circuit or a chip. The electronic device may be a terminal or other devices other than terminals. Exemplarily, the electronic device may be a mobile phone, a tablet computer, a laptop computer, a handheld computer, a vehicle-mounted electronic device, a Mobile Internet Device (MID), an augmented reality (AR) / virtual reality (VR) device, a robot, a wearable device, an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (PDA), etc. It may also be a server, a Network Attached Storage (NAS), a personal computer (PC), a television (TV), a teller machine, or a self-service machine, etc. The embodiments of the present application do not make specific limitations.

[0118] The protocol parsing device 200 of the ELF file in the embodiments of the present application may be a device with an operating system. The operating system may be an Android operating system, an iOS operating system, or other possible operating systems. The embodiments of the present application do not make specific limitations.

[0119] The protocol parsing device 200 of the ELF file provided in the embodiments of the present application can implement Figure 1 each process implemented by the method embodiments. To avoid repetition, it will not be elaborated here.

[0120] Optionally, as Figure 4 shown, the embodiments of the present application further provide an electronic device 300, including a processor 302 and a memory 304. A program or instruction that can run on the processor 302 is stored on the memory 304. When the program or instruction is executed by the processor 302, it implements each step of the above-mentioned protocol parsing method embodiments of the ELF file and can achieve the same technical effect. To avoid repetition, it will not be elaborated here.

[0121] It should be noted that the electronic devices in the embodiments of the present application include the above-mentioned mobile electronic devices and non-mobile electronic devices.

[0122] Figure 5 Schematic diagram of the hardware structure of an electronic device for implementing the embodiments of the present application.

[0123] The electronic device 400 includes, but is not limited to, components such as a radio frequency unit 401, a network module 402, an audio output unit 403, an input unit 404, a sensor 405, a display unit 406, a user input unit 407, an interface unit 408, a memory 409, and a processor 410.

[0124] Those skilled in the art can understand that the electronic device 400 may further include a power source (such as a battery) for supplying power to each component. The power source can be logically connected to the processor 410 through a power management system, so as to implement functions such as management of charging, discharging, and power consumption management through the power management system. Figure 5 The structure of the electronic device shown does not limit the electronic device. The electronic device may include more or fewer components than shown, or combine certain components, or have different component arrangements, which will not be elaborated here.

[0125] Among them, the processor 410 is used to perform a first reverse analysis on the ELF file to obtain file information.

[0126] The processor 410 is further used to perform a second reverse analysis on the ELF file based on the trained deep semantic learning model according to the file information to obtain protocol information.

[0127] The processor 410 is further used to determine protocol structure data based on the deep semantic learning model according to the protocol information and the file information.

[0128] The processor 410 is further used to perform a classification process on the protocol structure data to obtain a classification result.

[0129] The processor 410 is further used to output protocol parsing data according to the classification result.

[0130] In the embodiment of the present application, a first reverse analysis is performed on the ELF file to obtain file information; based on the trained deep semantic learning model, a second reverse analysis is performed on the ELF file according to the file information to obtain protocol information; based on the deep semantic learning model, protocol structure data is determined according to the protocol information and the file information; a classification process is performed on the protocol structure data to obtain a classification result; and protocol parsing data is output according to the classification result. In the embodiment of the present application, file information is obtained through the first reverse analysis, and then protocol information is obtained through the second reverse analysis based on the deep semantic learning model. Furthermore, based on the deep semantic learning model, protocol structure data is determined according to the protocol information and the file information, and the protocol structure data is classified and processed and then protocol parsing data is output. In this way, by combining the deep semantic learning model and the automated reverse technology, the accurate parsing of the ELF file protocol is realized, the protocol misjudgment rate is reduced, the accuracy of extracting protocol information is improved, redundant operations are avoided, the parsing time is reduced, and the efficiency of ELF file protocol parsing is improved.

[0131] Optionally, the processor 410 is specifically configured to: identify partitions of the file header information of the ELF file to obtain partition information of the ELF file; identify function boundaries of the ELF file to obtain function call information of the ELF file; check the interaction relationship between the data segment and the code segment in the partition information to determine data variable information of the ELF file.

[0132] In the above embodiments provided by the present application, the file header information of the ELF file is partitioned and identified to obtain partition information of the ELF file; the function boundaries of the ELF file are identified to obtain function call information of the ELF file; the interaction relationship between the data segment and the code segment in the partition information is checked to determine data variable information of the ELF file. In this way, comprehensive and accurate file information can be obtained, providing high-quality basic data for subsequent second reverse analysis based on the deep semantic learning model, determining protocol structure data, etc., enabling more accurate analysis based on the file information in the subsequent steps, and further improving the reliability and effectiveness of the entire ELF file protocol parsing.

[0133] Optionally, the processor 410 is further configured to: obtain a protocol data set of the target protocol; convert the protocol text in the protocol data set into structured features to obtain protocol feature data; pre-train a deep learning model to obtain a general deep semantic learning model; and fine-tune the general deep semantic learning model according to the protocol feature data to obtain a deep semantic learning model.

[0134] In the above embodiments provided by the present application, a protocol data set of the target protocol is obtained; the protocol text in the protocol data set is converted into structured features to obtain protocol feature data; a deep learning model is pre-trained to obtain a general deep semantic learning model; and the general deep semantic learning model is fine-tuned according to the protocol feature data to obtain a deep semantic learning model. In this way, the model is specially adapted and trained, can more accurately identify protocol-related elements and the relationships between them, reduce parsing errors, and improve the accuracy and reliability of the ELF file protocol parsing results.

[0135] Optionally, the processor 410 is specifically configured to: perform semantic analysis on the data segment and the code segment of the ELF file based on the trained deep semantic learning model to obtain protocol code information and protocol data interaction information; analyze the function call information, logical branches, and loop structures of the ELF file based on the trained deep semantic learning model to obtain protocol processing logic information and protocol generation logic information.

[0136] Based on the trained deep semantic learning model, the above embodiments provided by the present application perform semantic analysis on the data segment and code segment of the ELF file to obtain protocol code information and protocol data interaction information; based on the trained deep semantic learning model, analyze the function call information, logical branches, and loop structures of the ELF file to obtain protocol processing logic information and protocol generation logic information. In this way, based on the powerful semantic understanding ability of the deep semantic learning model, protocol information is obtained from multiple aspects such as code and data interaction and logical structure, making the parsed protocol information more comprehensive and complete, reducing information omission, providing richer and more accurate basic information for subsequent steps such as determining protocol structure data and classification processing, improving the quality of the entire ELF file protocol parsing, and effectively avoiding misjudgment of protocol information caused by semantic understanding deviation, making the finally obtained protocol parsing data closer to the actual operation situation of the protocol and enhancing the accuracy of protocol parsing.

[0137] Optionally, the processor 410 is specifically configured to: identify protocol feature data according to the protocol information; based on the deep semantic learning model, determine protocol structure data according to the protocol feature data and the code behavior data of the ELF file.

[0138] Based on the above embodiments provided by the present application, protocol feature data is identified according to the protocol information; based on the deep semantic learning model, protocol structure data is determined according to the protocol feature data and the code behavior data of the ELF file. In this way, key elements with representativeness and distinctiveness in the protocol can be mined, important information can be avoided from being omitted or wrong features can be extracted, and the structural framework of the protocol can be outlined more accurately, reducing structural misjudgment, improving the accuracy and reliability of the understanding of the protocol structure, and thus improving the accuracy of the overall ELF protocol parsing.

[0139] Optionally, the processor 410 is specifically configured to: use a protocol analyzer to determine the protocol type corresponding to the protocol structure data; classify the protocol fields in the protocol structure data, and extract key fields from the protocol fields; determine the classification processing result according to the protocol type and the key fields.

[0140] Based on the above embodiments provided by the present application, a protocol analyzer is used to determine the protocol type corresponding to the protocol structure data; the protocol fields in the protocol structure data are classified, and key fields are extracted from the protocol fields; the classification processing result is determined according to the protocol type and the key fields. In this way, by combining the protocol type information with the key field information, the final classification processing result can be made more comprehensive and accurate, providing a more reliable intermediate result for subsequent output of protocol parsing data, improving the quality and practicality of the entire ELF file protocol parsing, and facilitating analysts to make correct decisions based on accurate results.

[0141] It should be understood that in the embodiments of the present application, the input unit 404 may include a Graphics Processing Unit (GPU) 4041 and a microphone 4042. The GPU 4041 processes the image data of static pictures or videos obtained by an image capture device (such as a camera) in a video capture mode or an image capture mode. The display unit 406 may include a display panel 4061, and the display panel 4061 may be configured in the form of a liquid crystal display, an organic light emitting diode, etc. The user input unit 407 includes at least one of a touch panel 4071 and other input devices 4072. The touch panel 4071 is also referred to as a touch screen. The touch panel 4071 may include two parts: a touch detection device and a touch controller. The other input devices 4072 may include, but are not limited to, a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which will not be elaborated here.

[0142] The memory 409 can be used to store software programs and various data. The memory 409 mainly includes a first storage area for storing programs or instructions and a second storage area for storing data. Among them, the first storage area can store an operating system, applications or instructions required for at least one function (such as a sound playback function, an image playback function, etc.). In addition, the memory 409 may include a volatile memory or a non-volatile memory, or the memory 409 may include both a volatile memory and a non-volatile memory. Among them, the non-volatile memory may be a Read-Only Memory (ROM), a Programmable ROM (PROM), an Erasable PROM (EPROM), an Electrically EPROM (EEPROM), or a flash memory. The volatile memory may be a Random Access Memory (RAM), a Static RAM (SRAM), a Dynamic RAM (DRAM), a Synchronous DRAM (SDRAM), a Double Data Rate SDRAM (DDR SDRAM), an Enhanced SDRAM (ESDRAM), a Synch link DRAM (SLDRAM), and a Direct Rambus RAM (DRRAM). The memory 409 in the embodiments of the present application includes, but is not limited to, these and any other suitable types of memories.

[0143] The processor 410 may include one or more processing units; optionally, the processor 410 integrates an application processor and a modem processor. Among them, the application processor mainly processes operations related to the operating system, user interface, application programs, etc., and the modem processor mainly processes wireless communication signals, such as a baseband processor. It can be understood that the above-mentioned modem processor may not be integrated into the processor 410 either.

[0144] The embodiment of the present application further provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, it implements each process of the above-mentioned embodiment of the protocol parsing method of the ELF file, and can achieve the same technical effect. To avoid repetition, it will not be elaborated here.

[0145] Among them, the processor is the processor in the electronic device in the above-mentioned embodiment. The readable storage medium includes computer-readable storage media, such as computer read-only memory ROM, random access memory RAM, magnetic disk or optical disc, etc.

[0146] The embodiment of the present application further provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run a program or instruction to implement each process of the above-mentioned embodiment of the protocol parsing method of the ELF file, and can achieve the same technical effect. To avoid repetition, it will not be elaborated here.

[0147] It should be understood that the chip mentioned in the embodiment of the present application may also be referred to as a system-on-chip, system chip, chip system, or system-on-chip, etc.

[0148] The embodiment of the present application provides a computer program product, which is stored in a storage medium. The program product is executed by at least one processor to implement each process of the above-mentioned embodiment of the protocol parsing method of the ELF file, and can achieve the same technical effect. To avoid repetition, it will not be elaborated here.

[0149] It should be noted that in this article, the terms "including", "comprising", or any other variants thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device including a series of elements not only includes those elements but also includes other elements not expressly listed, or elements inherent to such process, method, article, or device. Without further limitation, an element defined by the statement "including one..." does not exclude the existence of additional identical elements in the process, method, article, or device including such element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in a reverse order according to the functions involved. For example, the described methods may be performed in an order different from that described, and various steps may be added, omitted, or combined. Additionally, the features described with reference to certain examples may be combined in other examples.

[0150] Through the description of the above embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus a necessary general hardware platform. Of course, it can also be implemented by hardware, but in many cases, the former is a better implementation. Based on such an understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art, can be embodied in the form of a computer software product. The computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disc) and includes several instructions for causing a terminal (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods of the various embodiments of the present application.

[0151] The embodiments of the present application have been described above in conjunction with the accompanying drawings. However, the present application is not limited to the above specific embodiments. The above specific embodiments are merely illustrative and not restrictive. Those of ordinary skill in the art, under the inspiration of the present application and without departing from the spirit and scope protected by the claims of the present application, can also make many forms, all of which fall within the protection scope of the present application.

Claims

1. A protocol parsing method for an ELF file, characterized in that: include: Perform the first reverse analysis on the ELF file to obtain the file information; Based on the trained deep semantic learning model, performing a second reverse analysis on the ELF file according to the file information to obtain protocol information; Based on the deep semantic learning model, determining protocol structure data according to the protocol information and the file information; Classifying and processing the protocol structure data to obtain a classification processing result; According to the classification processing result, the protocol parsing data is output.

2. The protocol parsing method of ELF file according to claim 1, characterized in that, The first reverse analysis of the ELF file is performed to obtain file information, including: Performing partition identification on the file header information of the ELF file to obtain partition information of the ELF file; Identify the function boundary of the ELF file to obtain function call information of the ELF file; The interactive relationship between the data segment and the code segment in the partition information is checked to determine the data variable information of the ELF file.

3. The protocol parsing method of ELF file according to claim 1, characterized in that, Before performing a second reverse analysis on the ELF file based on the trained deep semantic learning model according to the file information, the protocol parsing method further includes: Obtain a protocol data set of a target protocol; Converting the protocol text in the protocol data set into structured features to obtain protocol feature data; Pre-train the deep learning model to obtain a general model for deep semantic learning; The deep semantic learning general model is fine-tuned according to the protocol feature data to obtain the deep semantic learning model.

4. The protocol parsing method of ELF file according to claim 1, characterized in that: The method of performing a second reverse analysis on the ELF file based on the trained deep semantic learning model according to the file information to obtain protocol information includes: Using the trained deep semantic learning model, semantic analysis is performed on the data segment and the code segment of the ELF file to obtain protocol code information and protocol data interaction information; The trained deep semantic learning model is used to analyze the function call information, logic branches and loop structure of the ELF file to obtain protocol processing logic information and protocol generation logic information.

5. The protocol parsing method of ELF file according to claim 1, characterized in that: The determining the protocol structure data based on the deep semantic learning model and according to the protocol information and the file information includes: According to the protocol information, identifying protocol characteristic data; Based on the deep semantic learning model, the protocol structure data is determined according to the protocol feature data and the code behavior data of the ELF file.

6. A protocol parsing device for ELF files, characterized in that: include: The processing unit is used for performing a first reverse analysis on the ELF file to obtain file information; The processing unit is further configured to perform a second reverse analysis on the ELF file according to the file information based on the trained deep semantic learning model to obtain protocol information; The processing unit is further used to determine the protocol structure data based on the deep semantic learning model and according to the protocol information and the file information; The processing unit is further used to classify the protocol structure data to obtain a classification processing result; The output unit is used to output the protocol parsing data according to the classification processing result.

7. The protocol parsing device for ELF files according to claim 6, characterized in that: The processing unit is specifically used for: Performing partition identification on the file header information of the ELF file to obtain partition information of the ELF file; Identify the function boundary of the ELF file to obtain function call information of the ELF file; The interactive relationship between the data segment and the code segment in the partition information is checked to determine the data variable information of the ELF file.

8. The protocol parsing device for ELF files according to claim 6, characterized in that: Before performing a second reverse analysis on the ELF file based on the trained deep semantic learning model according to the file information, the processing unit is further used for: Obtain a protocol data set of a target protocol; Converting the protocol text in the protocol data set into structured features to obtain protocol feature data; Pre-train the deep learning model to obtain a general model for deep semantic learning; The deep semantic learning general model is fine-tuned according to the protocol feature data to obtain the deep semantic learning model.

9. The protocol parsing device for ELF files according to claim 6, characterized in that: The processing unit is specifically used for: Using the trained deep semantic learning model, semantic analysis is performed on the data segment and the code segment of the ELF file to obtain protocol code information and protocol data interaction information; The trained deep semantic learning model is used to analyze the function call information, logic branches and loop structure of the ELF file to obtain protocol processing logic information and protocol generation logic information.

10. The protocol parsing device for ELF files according to claim 6, characterized in that: The processing unit is specifically used for: According to the protocol information, identifying protocol characteristic data; Based on the deep semantic learning model, the protocol structure data is determined according to the protocol feature data and the code behavior data of the ELF file.

Images