论文部分内容阅读
应用层载荷特征是一种使用广泛、识别率高的指纹,但其生成主要依赖手工分析。针对该类特征的自动生成问题,提出一种基于程序不变量的指纹提取方法。该方法对应用程序进行插桩,跟踪应用程序处理协议数据包的过程,生成程序状态集并从中检测程序不变量,结合协议数据包中各个域的污点传播记录,获得数据包中存在的域间关系,进而提取出协议指纹。该方法具有效率高、不需分析协议语法语义、生成指纹精确性高等特点。
Application layer load characteristics is a widely used fingerprint with high recognition rate, but its generation mainly depends on manual analysis. Aimed at the automatic generation of such features, a fingerprinting method based on program invariants is proposed. In this method, the application is instrumented to track the process of application protocol packet processing, the program state set is generated and the program invariants are detected. Combined with the stain propagation records of each domain in the protocol packet, the method can obtain the interdomain Relationship, and then extract the agreement fingerprint. The method has the advantages of high efficiency, no need to analyze the grammar and semantics of the protocol, and has the advantages of high fingerprint accuracy.