基于连续段相似度的二进制网络协议报文类型识别
Message Type Identification of Binary Network Protocols using Continuous Segment Similarity
摘要：
基于流量跟踪的协议逆向工程通过分析可观测的网络消息来推断未知网络协议的行为。为了正确推导消息语义或行为分析，准确的消息类型识别是必不可少的第一步。然而，识别消息类型对于二进制协议来说特别困难，因为其结构特征隐藏在密集的数据表示中。我们利用二进制协议的内在结构特征，并提出了一个准确的方法来区分消息类型。我们的方法使用了一个相似性度量与连续的值范围，通过比较特征向量，其中向量元素对应于一个消息中的字段，而不是离散的字节值。这使得能够更好地识别结构模式，当只考虑精确的值匹配时，结构模式保持隐藏。我们结合Hirschberg对齐DBSCAN作为聚类算法，产生一个新的推理机制。通过应用新的自动配置方案，我们不需要手动配置参数的分析一个未知的协议，所需的早期方法。我们的评估结果表明，我们的方法具有相当大的优势，在消息类型识别结果的质量和执行性能比以前的方法。
英文摘要：
Protocol reverse engineering based on traffic traces infers the behavior of unknown network protocols by analyzing observable network messages. To perform correct deduction of message semantics or behavior analysis, accurate message type identification is an essential first step. However, identifying message types is particularly difficult for binary protocols, whose structural features are hidden in their densely packed data representation. We leverage the intrinsic structural features of binary protocols and propose an accurate method for discriminating message types. Our approach uses a similarity measure with continuous value range by comparing feature vectors where vector elements correspond to the fields in a message, rather than discrete byte values. This enables a better recognition of structural patterns, which remain hidden when only exact value matches are considered. We combine Hirschberg alignment with DBSCAN as cluster algorithm to yield a novel inference mechanism. By applying novel autoconfiguration schemes, we do not require manually configured parameters for the analysis of an unknown protocol, as required by earlier approaches. Results of our evaluations show that our approach has considerable advantages in message type identification result quality and also execution performance over previous approaches.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
