基于会话关联软件网络通信行为分析技术.docVIP

基于会话关联软件网络通信行为分析技术 　　文章编号:10019081(2013)07204605 　　doi:10.11772/j.issn.10019081.2013.07.2046 　　摘 要: 　　针对软件网络通信过程，提出一种基于会话关联的逆向分析方法，该方法首先对软件产生的网络通信流量和软件执行的应用程序编程接口(API)序列分别进行会话还原，再对还原的会话进行会话关联，为软件网络行为分析中的基于网络流量的分析方法和基于执行轨迹的分析方法建立了直接映射。设计并实现了相关的会话关联系统，并在此系统上进行了函数调用链的提取，使针对软件网络通信过程的分析更快捷。 　　关键词：软件网络通信过程分析；网络通信流量分析；应用程序编程接口序列分析；函数调用链 　　中图分类号：TP393文献标志码:A 　　英文标题 　　Behavior analysis technology of software network communication based on session association 　　英文作者名 　　DU Kunping*, KANG Fei, SHU Hui, SUN Jing 　　英文地址( 　　State Key Laboratory of Mathematical Engineering and Advanced Computing, Information Engineering University, Zhengzhou Henan 450001, China英文摘要) 　　Abstract: 　　 　　 　　According to the software network communication behavior, a reverse analytical method based on session association was proposed in this paper. The method restored the network traffic communication session and Application Programming Interface (API) sequence session produced by software firstly, then associated the sessions restored. Through the association, a direct mapping was built between two kinds of software network behavior analytical methods based on execution trace analysis and network traffic analysis respectively. The prototype system was designed and completed. Based on the system, the function call list was extracted. The reverse analytical method based on session association makes the reverse analysis of software network behaviors fast and convenient. 　　 　　According to the software network communication behavior, a reverse analysis method based on session association was proposed in this paper. The method restored the network traffic communication session and Application Programming Interface (API) sequence session produced by software firstly, then associating the session restored. Through the association, a direct mapping was built between two kinds of software network behavior analysis methods which are based on execution trace analysis and netw