关键词: 数据流分析, 网络协议逆向, 加密协议解析, 动态二进制插桩, 协议字段语义

Abstract: Reverse parsing unknown network protocol is of great significance in many network security applications. Most of the existing protocol reverse parsing methods can not handle the encryption protocol or get the semantic information of the protocol field. To solve this problem, a network protocol parsing technique based on dataflow analysis was proposed. According to the data flow recording tool developed on Pin platform, it could parse the network protocol with the aid of the dependence analysis based data flow tracking technology, as well as obtain the protocol format and semantic information of each protocol field. The experimental results show that the technique can parse out the protocol format correctly, especially for the encryption protocol, and extract the program behavior semantics of each protocol field.

Key words: dataflow analysis, network protocol reverse, encryption protocol parsing, dynamic binary instrumentation, protocol field semantic