Analysis of communication data of mobile terminal based on protocol reversal

Mingyuan ZHANG; Xinyu QI; Yubo SONG; Rongrong GU; Aiqun HU; Zhenchao ZHU

doi:10.11959/j.issn.2096-109x.2018099

您当前的位置：

首页 >

文章列表页 >

Analysis of communication data of mobile terminal based on protocol reversal

Papers | 更新时间：2024-06-03

- Analysis of communication data of mobile terminal based on protocol reversal
- Chinese Journal of Network and Information Security Vol. 4, Issue 12, Pages: 54-61(2018)
- 作者机构：
  
  1. 国家无线电监测中心检测中心，北京 100041
  2. 东南大学网络空间安全学院，江苏南京 211189
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2018099
  CLC： TN915.08
- Online First：2018-12，
  
  Published：15 December 2018
- 稿件说明：
移动端阅览
Mingyuan ZHANG, Xinyu QI, Yubo SONG, et al. Analysis of communication data of mobile terminal based on protocol reversal[J]. Chinese Journal of Network and Information Security, 2018, 4(12): 54-61.
DOI：

Mingyuan ZHANG, Xinyu QI, Yubo SONG, et al. Analysis of communication data of mobile terminal based on protocol reversal[J]. Chinese Journal of Network and Information Security, 2018, 4(12): 54-61. DOI： 10.11959/j.issn.2096-109x.2018099.

摘要

针对移动终端通信协议及通信数据的解析，其难点在于大部分移动终端应用程序并无相关公开的技术文档，难以获知其采取的通信协议类型。指令执行序列分析技术通过分析程序执行的指令序列逆向推断出消息格式和状态机。但有时序列信息采集不全，导致状态机推断不完备，从而无法获取全部协议信息。针对上述问题，提出了一个新型的基于状态机对比推断分析的移动终端通信协议解析方案，可用于取证场景提高数据取证的准确性和完备性。该方案首先利用PIN动态二进制插桩，识别污点源并跟踪污点轨迹分析出协议消息格式；然后根据格式信息对提取的协议消息进行聚类分析推断出原始状态机；最后利用最长公共子序列（LCS

longest common subsequence）算法与已知的协议状态机进行对比，相似度最高者即为推断出的通信协议类型。在Android平台上基于两类应用程序设计实验对该方案进行测试和评估，实验结果表明可准确提取应用程序的通信内容，实用价值强。

Abstract

The most problem in analysis of communication protocols and communication data for mobile terminals is that many mobile applications do not have the relevant public technical documents

and it is difficult to know the type of communication protocol it adopts.The instruction execution sequence analysis technique takes the instruction sequence executed by the program as a research object

and inversely infers the message format and the state machine to obtain the communication protocol.However

due to the incomplete collection of sequence information

the state machine infers that the inference is incomplete and cannot be effective.A novel protocol reverse scheme based on state machine comparison is proposed

which can be used for the forensics of mobile terminal communication data.The scheme first uses PIN for dynamical identification of the taint

and track it and analyzes the trajectory to obtain the message format.Secondly

the message clustering is performed on the basis of the message format to infer the protocol state machine.Finally

the LCS algorithm is used to compare the state machines to get a complete protocol state machine.This article tests and evaluates the scheme based on two types of application design experiments on the Android platform.The experimental results show that the results are both complete and real-time

and have practical value.

关键词

Keywords

references

SIJA B D , GOO Y H , KYU S S , et al . Survey on network protocol reverse engineering approaches,methods and tools [C ] // IEEE Network Operations and Management Symposium . 2017 : 271 - 274 .

PAN D , WANG Y , XUE Z . Remote control trojan vulnerability mining based on reverse analysis of network protocol [J ] . Computer Engineering , 2016 : 124 - 140

WEN S , MENG Q , FENG C , et al . Protocol vulnerability detection based on network traffic analysis and binary reverse engineering [J ] . Plos One , 2017 , 12 ( 10 ): 186 - 188 .

LI W , AI M , JIN B . A network protocol reverse engineering method based on dynamic taint propagation similarity [M ] . Intelligent Computing Theories and Application . Springer International Publishing , 2016 : 580 - 592 .

WEI X , LIU R , XU F . Reverse analysis of industrial control protocol based on static binary analysis [J ] . Application of Electronic Technique , 2018 : 366 - 372 .

BLUMBERGS B , VAARANDI R . BBUZZ:a bit-aware fuzzing framework for network protocol systematic reverse engineering and analysis [C ] // IEEE Military Communications Conference . 2017 : 707 - 712 .

SIJA B D , GOO Y H , SHIM K S , et al . Protocol reverse engineering methods for undocumented ethernet and wireless protocols;survey [C ] // Symposium of the Korean Institute of Communications and Information Sciences . 2017 : 281 - 312 .

GOO Y H , SHIM K S , CHAE B M , et al . Framework for precise protocol reverse engineering based on network traces [C ] // IEEE/IFIP Network Operations and Management Symposium . 2018 : 1 - 4 .

BARMPATSALON K , DAMOPOULOS D , KAMBOURAKIS G , et al . A critical review of 7 years of mobile device forensics [J ] . Digital Investigation , 2015 ,( 10 ): 323 - 349 .

DU J . Android mobile forensics privilege promotion [J ] . Silicon Valley , 2016 , 14 : 563 - 578 .

AL BARGHOUTHY N , MARRINGTON A . A comparison of forensic acquisition techniques for android devices:a case study investigation of or Web browsing sessions [C ] // 2014 6th International Conference on New Technologies Mobility and Security (NTMS) . 2014 : 1 - 4 .

JONKERS K . The forensic use of mobile phone flasher boxes [J ] . Digital Investigation , 2015 ,( 6 ): 168 - 178 .

JEON S , BANG J , BYUN K , et al . A recovery method of deleted record for SQLite database [J ] . Personal and Ubiquitous Computing , 2017 , 16 ( 6 ): 707 - 715 .

YANG Y T , ZU Z Y , SUN G Z . Historical data recovery from android devices [M ] // Future Information Technology . Berlin Heidelberg:Springer , 2016 : 251 - 257 .

GROBLER C , LOUWRENS C , VON SOLMS S . A multi-component view of digital forensics:fifth international conference on availability,reliability,and security [C ] // IEEE Piscataway . 2011 : 647 - 652 .

THING V L L , NG K Y , CHANG E C . Live memory forensics of mobile phones [J ] . Digital Investigation , 2015 : 74 - 82 .

Views

1331

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Progressive active inference method of protocol state machine

Trusted access scheme for intranet mobile terminal based on encrypted SD card

Related Author

Yan PAN

Wei LIN

Yuefei ZHU

Jiyang LI

Pengyuan ZHAO

Zhe LIU

Related Institution

School of Cyber Science and Engineering, Wuhan University

Key Laboratory of Aerospace Information Security ＆Trusted Computing,Ministry of Education,Wuhan University

School of Cyber Science and Engineering,Hebei University

⁰