消息和指令分析相结合的网络协议异常行为分析.pdf

36 11 Vol.36 No.11 2015 11 Journal on Communications November 2015 doi:10.11959/j.issn.1000-436x.2015256 1,2 1 1 1. 710071 2. 710086 Abnormal Disc Abnormal Disc TP393 A Message combined with instruction analysis for network protocol’s abnormal behavior 1, 2 1 1 HU Yan-jing , PEI Qing-qi , PANG Liao-jun (1. National Key Laboratory of Integrated Services Networks, Xidian University, Xi’an 710071, China; 2. Department of Electronics Engineering, Engineering University of the Armed Police Force, Xi’an 710086, China) Abstract: Pay close attention to the protocol’s abnormal behavior, and takes the message raw data and the protocol bi- nary code both as the analysis objects. The proposed method uses dynamic taint analysis combined with static analysis, firstly monitor and analyze the process of protocol program parses the message in our developed virtual platform Abnor- mal Disc prototype system, and record the protocol’s public behavior; then based on the proposed abnormal behavior perception and mining algorithm, static analyze the protocol’s abnormal behavior trigger conditions an