Abstract: Protocol state machine can describe the behavior of a protocol, which can help to understand the behavior logic of protocol. Oriented towards text protocols, a statistical method was firstly used to extract the semantic keyword of representative message type, and an adjacency matrix was used to describe the sequential relationship between the message types, based on which the protocol states were labeled and a state transition diagram was built. The experimental results show that the method can accurately describe the sequential relationship between the message types and abstract state machine model accurately.

Key words: protocol reverse, protocol semantic, protocol session, protocol state machine, adjacency matrix

摘要： 协议状态机可以描述一个协议的行为，帮助理解协议的行为逻辑。面向文本类协议，首先利用统计学方法提取表示报文类型的语义关键字；然后利用邻接矩阵描述报文类型之间的时序关系，基于时序关系进行协议状态标注，构建出协议的状态转换图。实验表明，该方法可以正确地描述出报文类型的时序关系，抽象出准确的状态机模型。

关键词: 协议逆向, 协议语义, 协议会话, 协议状态机, 邻接矩阵