基于协议逆向的移动终端通信数据解析

张明远; 祁欣妤; 宋宇波; 顾荣荣; 胡爱群; 朱珍超

doi:10.11959/j.issn.2096-109x.2018099

您当前的位置：

首页 >

文章列表页 >

基于协议逆向的移动终端通信数据解析

学术论文 | 更新时间：2024-06-03

- 基于协议逆向的移动终端通信数据解析
- Analysis of communication data of mobile terminal based on protocol reversal
- 网络与信息安全学报 2018年4卷第12期页码：54-61
- 作者机构：
  
  1. 国家无线电监测中心检测中心，北京 100041
  2. 东南大学网络空间安全学院，江苏南京 211189
- 作者简介：
  
  [ "张明远（1982-），男，内蒙古人，硕士，国家无线电监测中心检测中心工程师，主要研究方向为新型无线电检测技术。" ]
  [ "祁欣妤（1995-），女，江苏南京人，东南大学硕士生，主要研究方向为通信网络安全。" ]
  [ "宋宇波（1977-），男，江苏无锡人，博士，东南大学副教授，主要研究方向为通信网络安全及协议安全性分析。" ]
  [ "顾荣荣（1990-），女，江苏盐城人，东南大学硕士生，主要研究方向为智能移动终端。" ]
  [ "胡爱群（1952-），男，江苏南通人，博士，东南大学教授、博士生导师，主要研究方向为通信网络安全。" ]
  [ "朱珍超（1982-），男，安徽霍邱人，博士，东南大学讲师，主要研究方向为密码学与网络安全。" ]
- 基金信息：
  
  国家自然科学基金资助项目;The National Natural Science Foundation of China(61601113);中央高校基本科研业务费专项基金资助项目;The Fundamental Research Funds for the Central Universities of China(2242017K40013)
- DOI：10.11959/j.issn.2096-109x.2018099
  中图分类号： TN915.08
- 网络首发：2018-12，
  
  纸质出版：2018-12-15
- 稿件说明：
移动端阅览
张明远, 祁欣妤, 宋宇波, 等. 基于协议逆向的移动终端通信数据解析[J]. 网络与信息安全学报, 2018,4(12):54-61.

Mingyuan ZHANG, Xinyu QI, Yubo SONG, et al. Analysis of communication data of mobile terminal based on protocol reversal[J]. Chinese Journal of Network and Information Security, 2018, 4(12): 54-61.
张明远, 祁欣妤, 宋宇波, 等. 基于协议逆向的移动终端通信数据解析[J]. 网络与信息安全学报, 2018,4(12):54-61. DOI： 10.11959/j.issn.2096-109x.2018099.

Mingyuan ZHANG, Xinyu QI, Yubo SONG, et al. Analysis of communication data of mobile terminal based on protocol reversal[J]. Chinese Journal of Network and Information Security, 2018, 4(12): 54-61. DOI： 10.11959/j.issn.2096-109x.2018099.

摘要

针对移动终端通信协议及通信数据的解析，其难点在于大部分移动终端应用程序并无相关公开的技术文档，难以获知其采取的通信协议类型。指令执行序列分析技术通过分析程序执行的指令序列逆向推断出消息格式和状态机。但有时序列信息采集不全，导致状态机推断不完备，从而无法获取全部协议信息。针对上述问题，提出了一个新型的基于状态机对比推断分析的移动终端通信协议解析方案，可用于取证场景提高数据取证的准确性和完备性。该方案首先利用PIN动态二进制插桩，识别污点源并跟踪污点轨迹分析出协议消息格式；然后根据格式信息对提取的协议消息进行聚类分析推断出原始状态机；最后利用最长公共子序列（LCS

longest common subsequence）算法与已知的协议状态机进行对比，相似度最高者即为推断出的通信协议类型。在Android平台上基于两类应用程序设计实验对该方案进行测试和评估，实验结果表明可准确提取应用程序的通信内容，实用价值强。

Abstract

The most problem in analysis of communication protocols and communication data for mobile terminals is that many mobile applications do not have the relevant public technical documents

and it is difficult to know the type of communication protocol it adopts.The instruction execution sequence analysis technique takes the instruction sequence executed by the program as a research object

and inversely infers the message format and the state machine to obtain the communication protocol.However

due to the incomplete collection of sequence information

the state machine infers that the inference is incomplete and cannot be effective.A novel protocol reverse scheme based on state machine comparison is proposed

which can be used for the forensics of mobile terminal communication data.The scheme first uses PIN for dynamical identification of the taint

and track it and analyzes the trajectory to obtain the message format.Secondly

the message clustering is performed on the basis of the message format to infer the protocol state machine.Finally

the LCS algorithm is used to compare the state machines to get a complete protocol state machine.This article tests and evaluates the scheme based on two types of application design experiments on the Android platform.The experimental results show that the results are both complete and real-time

and have practical value.

关键词

Keywords

references

SIJA B D , GOO Y H , KYU S S , et al . Survey on network protocol reverse engineering approaches,methods and tools [C ] // IEEE Network Operations and Management Symposium . 2017 : 271 - 274 .

PAN D , WANG Y , XUE Z . Remote control trojan vulnerability mining based on reverse analysis of network protocol [J ] . Computer Engineering , 2016 : 124 - 140

WEN S , MENG Q , FENG C , et al . Protocol vulnerability detection based on network traffic analysis and binary reverse engineering [J ] . Plos One , 2017 , 12 ( 10 ): 186 - 188 .

LI W , AI M , JIN B . A network protocol reverse engineering method based on dynamic taint propagation similarity [M ] . Intelligent Computing Theories and Application . Springer International Publishing , 2016 : 580 - 592 .

WEI X , LIU R , XU F . Reverse analysis of industrial control protocol based on static binary analysis [J ] . Application of Electronic Technique , 2018 : 366 - 372 .

BLUMBERGS B , VAARANDI R . BBUZZ:a bit-aware fuzzing framework for network protocol systematic reverse engineering and analysis [C ] // IEEE Military Communications Conference . 2017 : 707 - 712 .

SIJA B D , GOO Y H , SHIM K S , et al . Protocol reverse engineering methods for undocumented ethernet and wireless protocols;survey [C ] // Symposium of the Korean Institute of Communications and Information Sciences . 2017 : 281 - 312 .

GOO Y H , SHIM K S , CHAE B M , et al . Framework for precise protocol reverse engineering based on network traces [C ] // IEEE/IFIP Network Operations and Management Symposium . 2018 : 1 - 4 .

BARMPATSALON K , DAMOPOULOS D , KAMBOURAKIS G , et al . A critical review of 7 years of mobile device forensics [J ] . Digital Investigation , 2015 ,( 10 ): 323 - 349 .

DU J . Android mobile forensics privilege promotion [J ] . Silicon Valley , 2016 , 14 : 563 - 578 .

AL BARGHOUTHY N , MARRINGTON A . A comparison of forensic acquisition techniques for android devices:a case study investigation of or Web browsing sessions [C ] // 2014 6th International Conference on New Technologies Mobility and Security (NTMS) . 2014 : 1 - 4 .

JONKERS K . The forensic use of mobile phone flasher boxes [J ] . Digital Investigation , 2015 ,( 6 ): 168 - 178 .

JEON S , BANG J , BYUN K , et al . A recovery method of deleted record for SQLite database [J ] . Personal and Ubiquitous Computing , 2017 , 16 ( 6 ): 707 - 715 .

YANG Y T , ZU Z Y , SUN G Z . Historical data recovery from android devices [M ] // Future Information Technology . Berlin Heidelberg:Springer , 2016 : 251 - 257 .

GROBLER C , LOUWRENS C , VON SOLMS S . A multi-component view of digital forensics:fifth international conference on availability,reliability,and security [C ] // IEEE Piscataway . 2011 : 647 - 652 .

THING V L L , NG K Y , CHANG E C . Live memory forensics of mobile phones [J ] . Digital Investigation , 2015 : 74 - 82 .

浏览量

1331

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

渐进式的协议状态机主动推断方法

基于加密SD卡的内网移动终端可信接入方案