The invention provides a semantic-level protocol format
inference method based on an execution trace. The semantic-level protocol format
inference method is characterized in that the protocol format adopted by a message is inferred according to a binary instruction execution trace generated in message analysis. The semantic-level protocol format
inference method comprises the following steps of: firstly, transferring an
intermediate language: transferring the instruction execution trace of a
protocol entity program in analyzing of a communication message into the form of the
intermediate language; secondly, implementing dynamic taint analysis of fine
granularity: carrying out the dynamic taint analysis of the fine
granularity based on the execution trace in form of the
intermediate language, in order to analyze the process of the
protocol entity program in analyzing the message, and mastering the spread and the influence of each message
byte serving as the input in the
system along with the execution of a
program instruction; and thirdly, inferring the semantic-level protocol format: gaining the complete protocol
message format based on the characteristics of the semantic-level protocol at the analysis stage; and the working process in the intermediate language transfer stage is that a binary instruction in the execution trace is individually converted into a simple and
semantic equivalence type intermediate language instruction, and an abstract execution trace based on the intermediate language is generated.