基于逆向分析的P2P加密协议识别方案

针对加密协议识别的难题,提出了一种基于逆向分析的协议识别方案,该方案在程序层面进行逆向分析解析出其通信过程和协议结构,在逆向分析的基础上结合流量特征对其进行识别。最后以当下最典型的Thunder为例进行试验,结果验证了方案的有效性,并能扩展到其他加密协议。该方案能够实时、准确地识别加密协议,从而能够更好地进行流量控制。

The identification scheme of P2P encryption protocol based on reverse analysis

With the development of P2P technology, more and more P2P private protocols uses encryption technology, the traditional protocol identification method has been a failure. Aiming at the problem , the paper proposes a protocol identification scheme based on reverse analysis, the scheme analyze the communication process and protocol structure in program level, and combine the characteristics of flow for identification. At last,take Thunder for test, the results demonstrate the effectiveness of the proposed method, and can be extended to other encryption protocosl. The scheme can identify the encryption protocol real-time and accuratly, and control the flow better.