飞信协议识别与多元通联关系提取方法

针对飞信协议尚未公开与复杂互联网环境带来的飞信各类应用相关协议识别困难以及单包通联关系缺失等问题,基于SIP协议的基本框架,从文本聊天、文件传输以及音/视频通信三方面解析了飞信常用业务的协议交互过程;提出了端口与正则表达式相结合的飞信协议识别方法和基于会话还原的飞信通联关系提取方法,能够从大量混杂的数据包中快速定位飞信业务报文,获得飞信多种通信行为的通联关系。实验结果证明了本文方法的有效性。

Protocol identification and multi-conversation relationship extraction in Fetion

As the protocols of Fetion are not public,it is difficult to recognize the Fetion application protocals caused by complex Internet environment and single-package conversation relationship is deficient,three common business protocol procedures（text messaging,file transfer and audio/video communication）are parsed on the basis of the basic framework of SIP protocol. The Fetion conversation relationship extraction method based on conversation revivification and protocol identification method of combining port and regular expressions are proposed for quickly locating Fetion service packets in promiscuous raw packets to achieve variety business relationships. Experimental results demonstratd the effectiveness of the method.