A Sequence Alignment Based Binary Unknown Protocol Message Format Division Method

Abstract

The invention discloses a binary unknown protocol message format division method based on sequence comparison, which includes the following main steps: preprocessing to obtain a single type of protocol sequence set; setting the result sequence; performing global sequence comparison and pairwise protocol sequence Local sequence alignment; merging the global sequence alignment results; recording the local sequence alignment results as similarity; integrating the alignment results into the result sequence; dividing the message format according to the result sequence, etc. Compared with schemes using methods such as hierarchical clustering, the present invention has lower algorithm time complexity, and can also effectively improve the problem of field position slippage caused by inserting too many blank spaces in the existing schemes during sequence alignment, and has better accuracy. efficiency and practicality.

Description

technical field [0001] The invention belongs to the technical field of network protocol analysis, and in particular relates to a method for dividing the binary unknown protocol message format based on sequence comparison. Background technique [0002] In 1967, R.A.Scantleburry and K.A.Bartlett of England's National Physical Laboratory first used the English word "protocol" to describe the process of data communication in a memo. Nowadays, various standardization organizations, network communication technology solution providers, Network operators have formulated corresponding public agreements. As the name implies, the specifications of this type of protocol are public, and the data format used is also in the known category, such as the hypertext transfer protocol most commonly used when mobile apps interact with the background, and the dynamic host configuration protocol used when configuring addresses in home routers. At the same time, for the purpose of commercial intere...

AI Technical Summary

Problems solved by technology

However, the existing private protocol packet format inference schemes have some defects

The PI project uses the unsupervised UPGMA clustering method for hierarchical clustering, which has high time complexity

Although Discoverer reduces the time complexity by constructing message attribute sequences, its processing method of dividing message samples by common text class delimiters is not suitable for binary protocols

[0004] The existing binary protocol division method based on sequence alignment still mainly uses the PI project as the basis for improvement, and considers improving the conventional technical means Needleman-Wunsch algorithm and Smith-Waterman algorithm itself, such as the steps of matrix construction in the improved algorithm, but The comparison process in the classic PI project is still basically retained, which has the disadvantages of high time complexity and lack of clear format division basis and methods

Images