基于主成分分析的网络报文细分
Refining Network Message Segmentation with Principal Component Analysis
摘要：
协议的逆向工程是网络服务安全分析中的一项常见任务。通信本身（在流量跟踪中捕获）包含执行此类协议逆向工程所需的大量信息。对未知消息的格式的理解对于人类不可读的二进制协议特别感兴趣。一个主要的挑战是发现消息中的可能字段，作为进一步分析的基础。给定一组消息，由现有的分段器分割成字节段，我们提出了一种方法来完善近似的字段推理。我们使用主成分分析（PCA）来发现消息段集之间的线性相关方差。我们重新定位的初始粗分割的边界，以更准确地匹配与真实的领域。我们进行不同的评估，我们的方法，以显示其效益的消息格式推理和后续的分析任务，从文献中依赖于消息格式。我们可以在不同的真实协议中实现消息格式准确性的中位数提高，最高可达100%。
英文摘要：
Reverse engineering of undocumented protocols is a common task in security analyses of networked services. The communication itself, captured in traffic traces, contains much of the necessary information to perform such a protocol reverse engineering. The comprehension of the format of unknown messages is of particular interest for binary protocols that are not human-readable. One major challenge is to discover probable fields in a message as the basis for further analyses. Given a set of messages, split into segments of bytes by an existing segmenter, we propose a method to refine the approximation of the field inference. We use principle component analysis (PCA) to discover linearly correlated variance between sets of message segments. We relocate the boundaries of the initial coarse segmentation to more accurately match with the true fields. We perform different evaluations of our method to show its benefit for the message format inference and subsequent analysis tasks from literature that depend on the message format. We can achieve a median improvement of the message format accuracy across different real-world protocols by up to 100 %.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
