【摘要】 针对加密协议识别的难题,提出了一种基于逆向分析的协议识别方案,该方案在程序层面进行逆向分析解析出其通信过程和协议结构,在逆向分析的基础上结合流量特征对其进行识别。最后以当下最典型的Thunder为例进行试验,结果验证了方案的有效性,并能扩展到其他加密协议。该方案能够实时、准确地识别加密协议,从而能够更好地进行流量控制。更多还原

【Abstract】 Aiming at the problem of encryption protocol identification,a protocol identification scheme based on reverse analysis is proposed. In the scheme,the communication process and protocol structure in program level are analyzed,and the combined with characteristics of flow for identification. At last,take Thunder for test,the results demonstrate the effectiveness of the proposed method,and can be extended to other encryption protocols. The scheme can identify the encryption protocol in real time and accurately and control the flow better.更多还原