未知二进制协议的网络消息字段类型分类与识别
Network Message Field Type Classification and Recognition for Unknown Binary Protocols
摘要：
基于记录的流量跟踪对未知网络协议进行逆向工程，可以对未记录的网络服务进行安全分析和调试。特别是对于二进制协议，现有方法（1）缺乏对消息中发现的段的数据类型进行分类或确定的综合方法，例如，在一个实施例中，一个数字，时间戳或网络地址，这将允许语义解释和（2）有很强的假设，防止分析低层协议往往发现在物联网或移动系统。在本文中，我们提出了第一个通用的方法来分析未知的消息从二进制协议，揭示数据类型的消息字段。为此，我们将消息分割成字节段，并使用它们的向量解释来计算相似性。这些可以用于创建具有相同类型的段的集群，并且还可以基于集群的特征来识别特定的数据类型。我们的广泛评估表明，我们的方法在大多数情况下提供了精确的分类，在合理的召回率下，数据类型识别精度高达100%，在现实场景中将最先进的技术提高了1.3到3.7倍。我们开放我们的实施，以方便后续工作。
英文摘要：
Reverse engineering of unknown network protocols based on recorded traffic traces enables security analyses and debugging of undocumented network services. In particular for binary protocols, existing approaches (1) lack comprehensive methods to classify or determine the data type of a discovered segment in a message, e.,g., a number, timestamp, or network address, that would allow for a semantic interpretation and (2) have strong assumptions that prevent analysis of lower-layer protocols often found in IoT or mobile systems. In this paper, we propose the first generic method for analyzing unknown messages from binary protocols to reveal the data types in message fields. To this end, we split messages into segments of bytes and use their vector interpretation to calculate similarities. These can be used to create clusters of segments with the same type and, moreover, to recognize specific data types based on the clusters' characteristics. Our extensive evaluation shows that our method provides precise classification in most cases and a data-type-recognition precision of up to 100% at reasonable recall, improving the state-of-the-art by a factor between 1.3 and 3.7 in realistic scenarios. We open-source our implementation to facilitate follow-up works.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
