WO2020155045A1 - Method and device for establishing communication model of network device - Google Patents

Abstract

Provided in embodiments of the present application are a method and a device for establishing a communication model of a network device. The method comprises: determining a plurality of different first binary sequences, wherein each of the first binary sequences corresponds to a request message; sending the determined plurality of the first binary sequences to the network device; obtaining response messages to the request messages corresponding to the plurality of the first binary sequences from the network device, wherein each of the response messages corresponds to one second binary sequence; determining a rule that each of the second binary sequences varies with each of the first binary sequences; and establishing the communication model of the network device according to the rule. The technical solutions of the embodiments can establish the communication model of the network device without knowing the communication mechanism of the network device, and provide important reference data for relevant application scenarios.

Description

Method and device for establishing communication model of network equipment Technical field

This application relates to the field of communications, and in particular to a method and device for establishing a communication model of network equipment.

Background technique

With the development of technology, more and more devices need to communicate with other devices through communication networks. In this article, these devices are collectively referred to as network devices. Network devices may include devices that access various communication networks. For example, the controlled devices (such as various sensors, servers, actuators, etc.) in various industrial control networks communicate with the controller through the industrial bus to realize automatic control and management; various intelligent equipment or facilities Information exchange through various wireless and/or wired communication networks to realize intelligent identification and management of equipment or facilities; vehicles interact with network platforms through the Internet of Vehicles to realize intelligent traffic management, intelligent dynamic information services and vehicles Intelligent control, etc. In many cases, it is necessary to analyze the actual communication behavior of the device to obtain a communication model that can reflect the communication behavior of the device. The communication model of a network device refers to a collection of a series of data used to describe how the network device responds to received network request information. The communication model of network equipment has important application value in many occasions. For example, the honeypot system can use the communication model of the network device to imitate the communication behavior of the network device, respond to the message from the attacker, make the attacker mistake it for the real system, and induce the attacker to carry out the attack to collect the attack. Behavior is used for analysis. At present, the analysis of device communication behavior is done manually by technicians, which requires a lot of time and manpower, high cost, long cycle, and low efficiency.

Technical content

In view of this, this application proposes a method and device for establishing a device communication model to automatically analyze the communication behavior of the device and establish a communication model.

On the one hand, an embodiment of the present application provides a method for establishing a communication model of a network device, which may include:

Determine a plurality of different first binary sequences, where each first binary sequence corresponds to a request message;

Sending the determined plurality of the first binary sequences to the network device;

Acquiring, from the network device, a plurality of response messages of the request message corresponding to the first binary sequence, where each response message corresponds to a second binary sequence;

Determining the law of each said second binary sequence changing with each said first binary sequence;

The communication model of the network device is established according to the rule.

On the other hand, an embodiment of the present application provides an apparatus for establishing a communication model of a network device, which may include:

A request determination module for determining a plurality of different first binary sequences, where each first binary sequence corresponds to a request message;

A sending module, configured to send the determined plurality of the first binary sequences to the network device;

A response obtaining module, configured to obtain a plurality of response messages of the request message corresponding to the first binary sequence from the network device, wherein each response message corresponds to a second binary sequence;

A model building module is used to determine the law of the change of each of the second binary sequences with each of the first binary sequences, and establish the communication model of the network device according to the law.

In another aspect, the embodiment of the present application also provides another apparatus for establishing a communication model of a network device, which may include a processor and a memory, wherein:

Computer-readable instructions are stored in the memory, and the instructions can be executed by the processor to implement the method for establishing a communication model of a network device of each embodiment.

In another aspect, an embodiment of the present application also provides a computer-readable storage medium storing computer-readable instructions, which may be used to make a processor execute the method for establishing a communication model of a network device in each embodiment.

It can be seen that the technical solutions of each embodiment try to use a plurality of binary sequences as request messages to communicate with the network device, and establish the communication model of the network device according to the response of the network device, which can be ignorant of the communication mechanism of the network device. Under the circumstances, the communication model of network equipment is established to provide important reference data for related application scenarios. This process can be executed by a computing device without human involvement, and a communication model can be established in a relatively short time. The establishment of the communication model is based on the analysis of a large number of binary sequences, so the communication model can more comprehensively and accurately reflect the communication behavior of network devices.

In various embodiments, the aforementioned communication model may include at least one of the following:

The corresponding relationship between the request message and the response message;

The inferred message type of the request message;

The inferred message type of the response message;

The inferred meaning of at least one field in the request message;

The inferred meaning of at least one field in the response message.

In this way, each embodiment can determine the content of the communication model according to the specific situation, which can include multiple aspects of information, so as to give as much information as possible to the communication behavior of the network device, and help related application scenarios to better understand the network device's performance. Communication behavior logic.

In each embodiment, the correspondence between the request message and the response message may include at least one of the following:

One said first binary sequence corresponds to a plurality of said second binary sequences;

A plurality of said first binary sequences corresponds to one said second binary sequence;

One said first binary sequence corresponds to one said second binary sequence;

One said first binary sequence corresponds to zero said second binary sequence;

A plurality of the first binary sequences corresponds to zero of the second binary sequences.

In this way, by giving the corresponding relationship between each request message and the response of the network device in the communication model, the communication model can simply and intuitively reflect the message sending and receiving logic of the network device, and the corresponding relationship can facilitate the search of messages and apply it to the honeypot. The system can improve the response speed of the honeypot system and simplify the message processing of the honeypot system.

In each embodiment, when determining the law of each of the second binary sequences changing with each of the first binary sequences, it is possible to:

Respectively intercepting a binary segment of a designated length from designated positions in a plurality of the first binary sequences;

Determine the rule that the response message of the request message corresponding to the plurality of first binary sequences changes with the binary segment.

In this way, by intercepting binary fragments from multiple request messages to analyze the law of the corresponding response message changing with the fragments, the communication model established according to the law can reflect the response logic of network devices to field-level information, so the communication model is more Meticulous and accurate.

In each embodiment, when the communication model of the network device is established according to the rule, it is possible to:

Each of the first binary sequences and/or each of the second binary sequences is determined according to the law that each of the second binary sequences changes with the components in each of the first binary sequences The inferred meaning of each component in the

The communication model is established according to the inferred meaning of each component.

It can be seen that by analyzing the relationship between each component in the request message and the response message, the inferred meaning of each component of the request message and/or response message can be determined. This information can make the communication model reflect the message processing logic of the network device More details facilitate more detailed and accurate analysis or imitation of the communication behavior of network devices.

In each embodiment, when determining the law of each second binary sequence changing with each component in each first binary sequence, it may be performed in at least one of the following ways:

When the plurality of the second binary sequences do not change with the first component in the corresponding plurality of the first binary sequences, the inferred meaning of the first component is determined as the message length and time , Check code, one or more of the values;

When the plurality of the second binary sequences change with the corresponding first components in the plurality of the first binary sequences, and the degree of change does not exceed the preset first threshold, the first The inferred meaning of a component is determined as a numerical value;

When the plurality of the second binary sequences change with the corresponding first components in the plurality of the first binary sequences, and the degree of change exceeds the first threshold, the first composition The meaning of part of the speculation is determined to be one or more of version information and type information;

When a plurality of first components of the first binary sequence appear in the corresponding second binary sequence, determine the inferred meaning of the first component as a session identifier or a value;

When the value of the second component in the plurality of the second binary sequences corresponding to the plurality of the first binary sequences continuously sent increases, the inferred meaning of the second component is determined as Counting information.

In this way, by using the preset field characteristics to speculate whether a certain component of the request message or the response message is a preset field type, the speculation process has better clarity and operability, and the speculation result is accurate and reliable.

In each embodiment, when the determined plurality of the first binary sequences are sent to the network device, they may be sent according to at least one of the following:

Sending one of the first binary sequences to the network device multiple times;

Sending a plurality of the first binary sequences to the network device multiple times in different orders;

Wherein, when determining the law of each second binary sequence changing with each of the first binary sequences, it is possible to:

Determine changes in multiple response messages corresponding to multiple transmissions of the same first binary sequence.

By sending the request message multiple times or in different order to the network device, it is possible to detect that the same request message corresponds to different response messages, so that the estimation of the message type or message structure is more complete and accurate.

In each embodiment, when the communication model of the network device is established according to the rule, it is possible to:

Determine the inferred message type of each of the first binary sequence and/or each of the second binary sequence according to the law of each of the second binary sequences changing with each of the first binary sequences ；

The communication model is established according to the inferred message type.

In this way, by analyzing the request message and its response message to obtain the message type of the request message or response message, the communication model can reflect the macro characteristics of the request message and/or response message through the message type, thereby making the communication model more accurate.

In each embodiment, each of the first binary sequences and/or each of the second binary sequences is determined according to the law that each of the second binary sequences changes with each of the first binary sequences The step of inferring the message type may include at least one of the following:

When a plurality of the first binary sequences correspond to the same second binary sequence, and it is determined that the second binary sequence is an error prompt message, the plurality of first binary sequences corresponds to The request message is determined to be an invalid request message;

When the plurality of second binary sequences are the same as a part of the corresponding first binary sequence, determining the response message corresponding to the plurality of second binary sequences as echo messages;

When a value of the second binary sequence is a Boolean value, the response message corresponding to the second binary sequence is determined as a status response message, and the request corresponding to the corresponding first binary sequence The message is determined to be a process request message;

When multiple second binary sequences received after sending one of the first binary sequences are different, it is determined that the request message corresponding to the first binary sequence is a request message related to time or status ；

When no response message is received after sending the first binary sequence, the request message corresponding to the first binary sequence is determined as a message that triggers an unknown failure of the network device.

It can be seen that by identifying invalid request messages, echo messages, process request messages and other message types, some special messages that cannot be described by the message structure are identified. Therefore, the established communication model is more comprehensive and accurate.

The technical solutions of the embodiments may further include:

Sending a plurality of different third binary sequences to the network device based on the established communication model of the network device;

Adjusting the communication model according to the received response message corresponding to the third binary sequence.

It can be seen that after the communication model is established, the communication model can also be verified by sending several request messages, and the communication model can be further adjusted to make the communication model more accurate and reliable.

Description of the drawings

Hereinafter, the preferred embodiments of the application will be described in detail with reference to the accompanying drawings, so that those of ordinary skill in the art will more clearly understand the above and other features and advantages of the application. In the accompanying drawings:

FIG. 1 is a schematic diagram of a scenario in which an analysis apparatus 20 in an embodiment of the application communicates with a network device.

Fig. 2 is a flowchart of a method for establishing a communication model of a network device according to an embodiment of the application.

Fig. 3A is a schematic diagram of an apparatus for establishing a communication model of a network device according to an embodiment of the application.

FIG. 3B is a schematic diagram of an apparatus for establishing a communication model of a network device according to an embodiment of the application.

FIG. 4 is a schematic diagram of the correspondence between request messages and response messages in an embodiment of the application.

Fig. 5 is a schematic diagram of a message field parsing principle according to an embodiment of the application.

Fig. 6 is a schematic diagram of a speculative message structure according to an embodiment of the application.

Fig. 7 is a schematic diagram of a honeypot system according to an embodiment of the application.

Among them, the reference signs are as follows:

Serial number	meaning
10	Network equipment
20	Analysis device 20
30	Communication connection
200	method
S11～S15		step
210	Request determination module
220	Send module
230	Response acquisition module

240	Model building module
250	processor
260	Memory
261	Request determination module
262	Send module
263	Response acquisition module
264	Model building module
51	Root node
521, 522～52n	Child node
5n1、5n2～5nn		Leaf node
61	Field
62	news
63	Inferred meaning of the field
71	Traffic distributor
72	Flow analyzer
73	Physical equipment
74	Virtual device

detailed description

In order to make the purpose, technical solutions, and advantages of this application clearer, the following examples will further illustrate this application in detail.

The network devices in various communication networks may be attacked from the communication network or there may be technicians who need to analyze their communication behaviors. Therefore, it is necessary to establish a communication model for such network devices. To this end, each embodiment of the present application provides a device (hereinafter referred to as the analysis device) for analyzing the communication behavior of a network device, and then establishing its communication model. FIG. 1 is a schematic diagram of a scenario in which an analysis apparatus in an embodiment of the application communicates with a network device. As shown in FIG. 1, the analysis device 20 and the network device 10 communicate through a communication connection 30. The communication connection 30 can be any wired or wireless connection; it can be a direct connection, or an indirect connection through a certain network or other equipment.

The network device 10 may be a device connected to any communication network. The communication network may include but is not limited to: industrial control network, Internet of Things, Internet of Vehicles, local area network, Internet, cellular communication network, etc.

The network device 10 can access a communication network through a certain type of communication interface. In some embodiments, the analysis device 20 can communicate with the network device 10 through the same type of communication interface. For the network device 10, the analysis device 20 is also a network device 10 in the network that can communicate with it. For example, the analysis device 20 may access the communication network to which the network device 10 belongs, and communicate with the network device 10 as a device in the communication network. In other embodiments, the analysis device 20 may communicate with the network device 10 through different types of communication interfaces. For example, the network device 10 can access a communication network through a Wi-Fi interface, and the analysis device 20 can communicate with the network device 10 through a Bluetooth interface of the network device 10. Therefore, this application does not limit the communication medium and network protocol used by the analysis device 20 to communicate with the network device 10, that is, according to the OSI seven-layer communication model, the communication mechanisms of the physical layer, the data link layer, and the network layer are important to this application. , Is only a channel for message transmission, and this application does not limit the type of this channel.

In various embodiments, the analysis device 20 may try to send some binary sequences as request messages to the network device 10, and obtain the response of the network device 10 to these request messages, and establish a communication model of the network device 10 accordingly. FIG. 2 is a flowchart of a method 200 for establishing a communication model of a network device 10 according to an embodiment of the application. The method 200 may be executed by a device, such as the analysis device 20 in FIG. 1. As shown in Figure 2, the method may include the following steps.

Step S11: Determine a plurality of different first binary sequences, where each first binary sequence corresponds to a request message.

Step S12, sending the determined plural first binary sequences to the network device 10.

Step S13: Obtain a plurality of response messages of the request message corresponding to the first binary sequence from the network device 10, where each response message corresponds to a second binary sequence.

Step S14: Determine the law of each second binary sequence changing with each first binary sequence.

Step S15, establishing a communication model of the network device 10 according to the law.

Wherein, the plurality of first binary sequences may have the same or different lengths. One or more designated lengths may be determined according to pre-configured information, and a plurality of binary sequences may be determined for each designated length as the first binary sequence. For example, the analysis device 20 may pre-configure the default length value of the request message, or may receive the length value input through the human-machine interface. These length values can be multiple discrete values, such as 16, 32, 64, etc., and the unit can default to bits or bytes. These length values can also be a length range (such as 8-64), or a maximum length (such as 128). The analysis device 20 can determine each possible length of the request message that needs to be tried to be sent according to the default length value and the length value input by the human-machine interface.

For a certain specified length, the analysis device 20 may determine the first binary sequence with the specified length according to preset configuration information. In some embodiments, the analysis device 20 may regard each binary sequence with the specified length as a first binary sequence according to the default configuration. For example, when the specified length is 16 bits, the analysis device 20 may regard each binary number from 0x0000 to 0xFFFF as a first binary sequence. In some embodiments, the analysis device 20 may determine a binary sequence having the specified length and conforming to the characteristic as the first binary sequence according to the characteristic of the pre-configured request message. For example, if the feature of the request message is that the nth bit cannot be 0, the analysis device 20 may regard each binary sequence with the specified length and the nth bit not being 0 as a first binary sequence.

After each first binary sequence is sent to the network device 10, the analysis device 20 may receive a response message fed back by the network device 10, and each response message is also a binary sequence, which is referred to herein as a second binary sequence. The analysis device 20 may record the correspondence between the first binary sequence and the second binary sequence of the corresponding response message. In some cases, the analysis device 20 may not receive a response message from the network device 10 for certain first binary sequences. At this time, the analysis device 20 may record the second binary sequence corresponding to the first binary sequence. An empty sequence, that is, a sequence without any elements.

The analysis device 20 can establish a communication model of the network device 10 according to the law of the change of each second binary sequence with each first binary sequence. The law that each second binary sequence changes with each first binary sequence refers to the various differences between a plurality of first binary sequences as a request message and a plurality of second binary sequences as a response message. The relationship includes the relationship between each request message and its response message, and the relationship between the response messages corresponding to multiple request messages, etc. The communication model of the network device 10 refers to a collection of a series of data used to describe the manner in which the network device 10 responds to a received request message. The communication model can include any information related to the request message and/or the response message.

In some embodiments, the analysis device 20 may be implemented by hardware, such as FPGA, ASIC, and so on. FIG. 3A is a schematic diagram of an apparatus for establishing a communication model of the network device 10 (that is, the analysis apparatus 20 in FIG. 1) according to an embodiment of the application. As shown in FIG. 3A, the device 20 may include: a request determining module 210, a sending module 220, a response obtaining module 230, and a model building module 240.

The request determination module 210 may determine a plurality of different first binary sequences, where each first binary sequence corresponds to a request message.

The sending module 220 may send the determined plural first binary sequences to the network device 10.

The response obtaining module 230 may obtain a plurality of response messages of the request message corresponding to the first binary sequence from the network device 10, wherein each response message corresponds to a second binary sequence.

The model establishment module 240 can determine the law of each second binary sequence changing with each of the first binary sequences, and establish a communication model of the network device 10 according to the law.

In some embodiments, the analysis device 20 may also be implemented by a general-purpose processor running instructions. FIG. 3B is a schematic diagram of another apparatus for establishing a communication model of the network device 10 (that is, the analyzing apparatus 20 in FIG. 1) according to an embodiment of the application. As shown in FIG. 3B, the apparatus 20 may include a processor 250 and a memory 260.

The memory 260 may store a request determination module 261, a sending module 262, a response obtaining module 263, and a model building module 264 implemented by computer-readable instructions. The computer-readable instructions corresponding to the request determining module 261, the sending module 262, the response acquiring module 263, and the model establishing module 264 can be executed by the processor 250 to implement the same as the request determining module 210 and the sending module 220 shown in FIG. 3A. The similar functions of the response acquisition module 230 and the model establishment module 240 are not repeated here.

It can be seen that the technical solutions of each embodiment try to use a plurality of binary sequences as request messages to communicate with the network device 10, and establish a communication model of the network device 10 according to the response of the network device 10, which can be used in the communication mechanism of the network device 10. The communication model of the network device 10 is established without knowledge to provide important reference data for related application scenarios. This process can be executed by a computing device without human involvement, and a communication model can be established in a relatively short time. The establishment of the communication model is based on the analysis of a large number of binary sequences, so the communication model can more comprehensively and accurately reflect the communication behavior of the network device 10.

In some embodiments, when the analysis device 20 sends each first binary sequence as a request message, some first binary sequences may be sent to the network device 10 more than once. For example, in order to detect whether the response message of a request message is related to the sending timing of the request message, or whether the response message is related to the number of times the request message is sent, the analysis device 20 may send a first binary sequence to the network device 10 multiple times. , And obtain the response message corresponding to each request message. For another example, in order to detect whether the response messages of several request messages are related to the sending order of these request messages, the analysis device 20 may send a plurality of different first binary sequences to the network device 10 multiple times in different orders, and A group of response messages corresponding to each group of the first binary sequence are obtained respectively. At this time, when determining the law of each second binary sequence changing with each first binary sequence, the analysis device 20 can determine the change of multiple response messages corresponding to multiple transmissions of the same first binary sequence As part of the law.

In this way, by sending request messages to the network device 10 multiple times or in different orders, it can be detected that the same request message corresponds to different response messages, such as whether the response is related to time or the state of the network device 10, so that the message type Or the prediction of the message structure is more complete and accurate.

In various embodiments, the communication model of the network device 10 may include various information related to the request message and/or the response message. For example, the communication model may include, but is not limited to, at least one of the following:

The correspondence between the request message and the response message,

Speculative message type of request message,

The inferred message type of the response message,

The inferred meaning of at least one field in the request message,

The inferred meaning of at least one field in the response message, etc.

It can be seen that by allowing the communication model to include multiple aspects of information, the analysis device 20 can determine the content of the communication model according to specific conditions, thereby giving as much detailed information as possible to the communication behavior of the network device 10, and helping related application scenarios better Understand the communication behavior logic of the network device 10.

Determine the correspondence between the request message and the response message

The correspondence between the request message and the response message may include, but is not limited to, at least one of the following: a first binary sequence corresponds to multiple second binary sequences, and multiple first binary sequences correspond to one second binary sequence. Binary sequence, a first binary sequence corresponds to a second binary sequence, a first binary sequence corresponds to an empty sequence, multiple first binary sequences correspond to an empty sequence, etc. Here, an empty sequence indicates that the analysis device 20 has not received a response message from the network device 10. After the analysis device 20 tries to send each first binary sequence and obtains the corresponding response message, it can summarize the relationship between each first binary sequence and its response message to obtain the first binary sequence. The corresponding relationship between the sequence and the second binary sequence. For example, FIG. 4 is a schematic diagram of the correspondence between request messages and response messages in an embodiment of the application. Among them, request message 1 corresponds to response messages 1-1 and 1-2, request messages 2, 3, and 4 all correspond to the same response message 2-1, and request message N corresponds to response message N-1, where N is a positive integer, and many more. Each request message and each response message are a binary sequence, and the binary sequence corresponding to the response message may include an empty sequence.

In this way, by giving the corresponding relationship between each request message and the response of the network device 10 in the communication model, the communication model can simply and intuitively reflect the message sending and receiving logic of the network device 10, and the corresponding relationship can facilitate the search of messages. The honeypot system can improve the response speed of the honeypot system and simplify the message processing of the honeypot system.

Analysis of message types

In some embodiments, the communication model may include a speculative message type of the request message and/or a speculative message type of the response message. The analysis device 20 can determine the inferred message type of each first binary sequence and/or each second binary sequence according to the law of the change of each second binary sequence with each first binary sequence, and according to the guess The type of message to establish a communication model. In this way, by analyzing the request message and its response message to obtain the message type of the request message or response message, the communication model can reflect the macro characteristics of the request message and/or response message through the message type, thereby making the communication model more accurate.

In each embodiment, in order to determine the inferred message type of each first binary sequence and/or each second binary sequence, the analysis device 20 may be preset with features of multiple preset message types, and the analysis device 20 These features can be used to infer the message type of the request message and/or response message. The characteristics of the preset message types may include the characteristics of general message types, the characteristics of request message types, and the characteristics of response message types. Among them, the characteristics of the message type corresponding to the request message may include not only the characteristics of the request message itself, but also the characteristics of the response message corresponding to the request message, and the characteristics of the relationship between the request message and its response message, and so on. The characteristics of the response message may include not only the characteristics of the response message itself, but also the characteristics of the request message corresponding to the response message, and the characteristics of the relationship between the response message and its request message, and so on. Using the characteristics of these preset message types, the analysis device 20 can determine each first binary sequence and/or second binary sequence according to the obtained second binary sequence corresponding to each first binary sequence The guessed message type. For example, the method for determining the message type may include, but is not limited to at least one of the following:

When a plurality of first binary sequences correspond to the same second binary sequence, and the second binary sequence is determined to be an error prompt message, the request messages corresponding to the plurality of first binary sequences are determined to be invalid Request message

When the plurality of second binary sequences are the same as a part of the corresponding first binary sequence, the response message corresponding to the plurality of second binary sequences is determined as an echo message (Echo);

When the value of a second binary sequence is a Boolean value, the response message corresponding to the second binary sequence is determined as the status response message, and the request message corresponding to the corresponding first binary sequence is determined as the process Request message

When multiple second binary sequences received after sending a first binary sequence multiple times are different, determining that the request message corresponding to the first binary sequence is a request message related to time or status;

When no response message is received after sending a first binary sequence, the request message corresponding to the first binary sequence is determined as a message that triggers an unknown failure of the network device 10.

Among them, a certain second binary sequence can be determined as an error message in various ways. For example, the analysis device 20 may preset a characteristic of a response message for prompting an error, and a certain second binary sequence may be determined as an error prompt message based on the characteristic. For another example, when a large number of first binary sequences are tried as the request message, the second binary sequence whose number of occurrences exceeds a preset threshold in the received second binary sequence may be determined as an error prompt message. For another example, the characteristics of the request message can be preset in the analysis device 20, and one or several first binary sequences that do not meet the characteristics of the request message can be sent to the network device 10, and the response message fed back by the network device 10 is determined as an error. Prompt message. Here are just a few simple examples, and other embodiments can also be implemented by other methods.

The echo message means that the network device 10 sends back the received message content intact as a response message. The analysis device 20 may record the second binary sequence completely consistent with the corresponding first binary sequence as an echo message, and record the corresponding first binary sequence as a request message that triggers the echo message.

The process request message refers to a request message for requesting the network device 10 to perform a certain preset process. At this time, the network device 10 will feed back a status response message. The content of the status response message is whether the process is successfully executed, so it is a Boolean value. Therefore, when a certain second binary sequence is a Boolean value, the second binary sequence can be inferred as a status response message, and the corresponding first binary sequence can be inferred as a process request message.

The inferred message type determined in the above process can be used as a part of the communication model, and can also be used as an intermediate result in the subsequent analysis process to generate more detailed analysis results. For example, when it is determined that the request message is a request message related to time or status, various components of the request message can be analyzed in the subsequent process, so as to determine that the request message and/or the corresponding response message are related to time. Or state-related components.

It can be seen that by identifying invalid request messages, echo messages, process request messages and other message types, some special messages that cannot be described by the message structure are identified. Therefore, the established communication model is more comprehensive and accurate.

Field analysis

In some embodiments, the communication model may include the inferred meaning of at least one field in the request message and/or the response message. The analysis device 20 can determine each first binary sequence and/or each component in each second binary sequence according to the law of each second binary sequence changing with each component in each first binary sequence Part of the inferred meaning, and build a communication model based on the inferred meaning of each component. By analyzing the relationship between the various components of the request message and the response message, the inferred meaning of the various components of the request message and/or response message can be determined. This information can make the communication model reflect the message processing logic of the network device 10. The multiple details facilitate a more detailed and accurate analysis or imitation of the communication behavior of the network device 10.

Generally, the requirements for establishing a communication model are based on a situation where the communication mechanism of the network device 10 is completely unknown, that is, there is no known information about the format and content of the messages sent and received by the network device 10. Therefore, when determining the inferred meaning of a field in the request message, the analysis device 20 needs to complete two tasks. One is to determine the length of each field in the request message, and the other is to analyze the inferred meaning of each field.

The analysis device 20 can respectively intercept binary fragments of a specified length from the specified positions in the plurality of first binary sequences as a component, and determine that the response message of the request message corresponding to the plurality of first binary sequences changes with the binary fragments The law. If the change rule of the response message with a binary segment can be found, the binary segment is determined to be a field.

Generally, a message can include fixed-length fields as well as variable-length fields. For a fixed-length field, the length of the field in each message is a preset length. For a variable-length field, a preset boundary value is usually used to indicate the end of the field.

In some embodiments, the analysis device 20 may be pre-configured with one or more designated lengths, which may be a common designated length for each field, or may be respective designated lengths of different fields. For example, the analysis device 20 can be pre-configured with a default length value, or can receive a length value input through a human-machine interface. These length values can be multiple discrete values, such as 1, 2, 8, etc., and the unit can default to bits or bytes. These length values can also be a length range (such as 1-16), or a maximum length (such as 32). The analysis device 20 can determine all possible lengths of the binary fragments that need to be intercepted according to the default length value and the length value input by the human-machine interface, and respectively try to intercept the binary fragments corresponding to each possible length from the request message, and analyze whether they are A field. For another example, a plurality of predefined templates may be pre-configured in the analysis device 20. A predefined template refers to a predefined message structure, including the length and/or meaning of each field. The analysis device 20 may sequentially intercept binary fragments corresponding to the length of each field from the request message according to a predefined template, and analyze whether it is a field.

In some embodiments, the analysis device 20 may also detect the boundary value of a preset field in the binary sequence of the message, so as to determine a possible boundary of a field. For example, when the analysis device 20 detects a predetermined value in the message, such as "\n", "\0" and other corresponding binary fragments, it can be considered as a field boundary.

In some embodiments, the request message can be regarded as a binary sequence composed of multiple binary segments. Therefore, a tree similar to an analysis model can be used to analyze the structure of the request message and the relationship between the request message and the response message. Fig. 5 is a schematic diagram of a message field parsing principle according to an embodiment of the application. As shown in Fig. 5, the request message can be parsed block by block starting from one end (for example, the starting position) of the request message. For the first block to be parsed, binary fragments (also called fields, blocks) of specified lengths can be intercepted from one end of the message according to different specified lengths to analyze the possible length of the first block and its inferred meaning . When it is determined that the first block has more than one possible length, a parse tree can be established with the first block of each possible length as the root node 51, and the length and the length of the first block are recorded in the parse tree. One or more speculative meanings. The analysis device 20 can start from the end position of the first block, repeat the above analysis process, obtain various possible lengths and inferred meanings of the second block, and use the various possibilities of the second block as the root node 51 Each child node 521, 522~52n of. Repeat the above process until all the content of the request message is parsed, and it will reach the leaf nodes 5n1, 5n2~5nn of the tree. Each leaf node 5n1, 5n2-5nn can correspond to one or more response messages, where n is a positive integer.

When analyzing a first binary sequence, the analyzing device 20 can use other one or more first binary sequences and the information of their response messages. In some embodiments, the network device 10 may adopt more than one request message structure. When analyzing a first binary sequence, the analyzing device 20 determines that the structural feature of another first binary sequence does not conform to the structural feature of the first binary sequence currently analyzed, it can be considered that the other first binary sequence The binary sequence adopts a different message structure and re-analyzes it in the above-mentioned manner to obtain one or more message structures corresponding to the other first binary sequence.

After parsing the set of all possible message structures of all possible request messages, the message structure of one or more possible request messages can be obtained, including the length of each field and one or more inferred meanings. One or more speculative message structures obtained and the first binary sequence and/or the second binary sequence of each message structure can be added to the created communication model. In the above-mentioned parsing process of the request message, or after the parsing process ends, the analysis device 20 may perform similar parsing on the response message, and the parsing process may use the parsing result of the corresponding request message to obtain the inferred message structure of the response message And the inferred meaning of the fields in it.

In this way, by intercepting binary fragments from multiple request messages to analyze the law of the corresponding response message changing with the fragments, the communication model established according to the law can reflect the response logic of the network device 10 to field-level information. Therefore, the communication model More detailed and accurate.

In the field analysis process of each embodiment, the analysis device 20 can determine the inferred field type of each block (that is, the binary segment, the component part of the message) according to the characteristics of various preset field types configured in advance. For example, the method for inferring the field type may include, but is not limited to, at least one of the following:

When the plural second binary sequences do not change with the first component of the corresponding plural first binary sequences, the meaning of the guess of the first component is determined as the message length, time, check code, and value One or more of

When the plurality of second binary sequences changes with the first component in the corresponding plurality of first binary sequences, and the degree of change does not exceed the preset first threshold, the guess of the first component The meaning is determined as a numerical value;

When the plural second binary sequences change with the first component in the corresponding plural first binary sequences, and the degree of change exceeds the first threshold, the inferred meaning of the first component is determined as the version One or more of information and type information;

When the first component of the plurality of first binary sequences appears in the corresponding second binary sequence, the inferred meaning of the first component is determined as the session identifier or value;

When the value of the second component in the plurality of second binary sequences corresponding to the plurality of consecutive first binary sequences increases, the inferred meaning of the second component is determined as counting information.

Among them, when the change of the first component in the request message does not cause a change in the response message, if the value of the first component is equal to the length of the request message, the inferred meaning of the first component can be determined as the message length ; If the value of the first component meets the preset time pattern, the inferred meaning of the first component can be determined as time; if the value of the first component is equal to a certain value obtained by performing a preset algorithm on the request message When a checksum is selected, the inferred meaning of the first component can be determined as the check code; otherwise, the inferred meaning of the first component can be determined as a numerical value.

When the degree of change of the response message does not exceed the preset first threshold, the inferred meaning of the first component may be determined as a numerical value. Here, the first threshold may refer to the number of bits in the second binary sequence, or the percentage of the changed number of bits in the total length of the second binary sequence, etc.

For a block, the analysis device 20 can determine the meaning of a plurality of speculations in a recognition step. The analysis device 20 can record the meaning of all possible guesses of the block, and can exclude some of the guesses in the subsequent identification step. For example, in a recognition step, it is determined that the speculative meaning of a block includes version information and type information; in a subsequent recognition step, the speculative meaning of the component can be determined as version information according to the position of the block. For example, the analysis device 20 may preset: when a block is located in the first 30% of the sequence, the speculative meaning of the block may be version information, message length, etc., and the speculative meaning of the block does not include a check code, etc. . In this way, the meaning of the block speculation can be identified one by one according to each preset judgment condition.

Fig. 6 is a schematic diagram of a speculative message structure according to an embodiment of the application. As shown in FIG. 6, the speculative message structure includes the position and length of each field 61 in the message in the message 62, and at least one speculative meaning 63.

In this way, by using the preset field characteristics to speculate whether a certain component of the request message or the response message is a preset field type, the speculation process has better clarity and operability, and the speculation result is accurate and reliable.

The above-mentioned message type determination process and field analysis process can be performed at any time.

For example, after a first binary sequence is sent, the message type and the fields in the first binary sequence can be analyzed.

For another example, after sending the first binary sequences of all rounds, the message types of each first binary sequence and the fields therein may be parsed.

For another example, after a first binary sequence is sent, the message type and the fields in the first binary sequence can be parsed, and during the parsing process, the relevant one or more first binary sequences can be analyzed. The control sequence is sent multiple times. After analyzing the message types and field meanings of these first binary sequences, try to send another first binary sequence that has not been sent, and analyze the message types and fields. For example, in the above-mentioned message type determination process and field analysis process, other related first binary sequences can be sent as needed. For example, when it is detected that the response messages obtained from two transmissions of a certain first binary sequence are different, the preset processing method for this situation can be used for the first binary sequence and the related multiple first and second sequences. The base sequence performs multiple rounds of transmission for a preset number of times, and in different rounds, the transmission order of each sequence can also be adjusted. For another example, in order to analyze whether a certain block of the first binary sequence is a field, the content of the first binary sequence except for the block can be unchanged according to a preset method, and only the block is assigned With different values, a plurality of binary sequences are obtained, these binary sequences are sent to the network device 10, and the corresponding response message is obtained, based on which it can be obtained whether the block is a field or the inferred meaning of the field.

The specific sending and parsing process can be determined according to needs, and there is no restriction here.

In each embodiment, after the communication model of the network device 10 is established, the analysis device 20 may also send a plurality of different third binary sequences to the network device 10 based on the established communication model of the network device 10, and according to the received The response message corresponding to the third binary sequence adjusts the communication model. This adjustment process can be performed by an adjustment module (not shown) in the analysis device 20.

Sending a plurality of different third binary sequences to the network device based on the established communication model of the network device;

Adjusting the communication model according to the response message corresponding to the third binary sequence obtained from the network device.

For example, when the received response message for a certain third binary sequence is inconsistent with the response message corresponding to the request message that is the same as the third binary sequence in the communication model, the third binary sequence and The related sequence (for example, the sequence of several request messages related to its sending order in response, etc.) is sent to the network device 10 again (or multiple times), and the communication model is adjusted according to the received response message. The corresponding relationship between request messages with the same control sequence and their response messages.

For another example, according to a received response message for a third binary sequence, the message type of the third binary sequence is derived from the message type corresponding to the request message that is the same as the third binary sequence in the communication model When they are inconsistent, the third binary sequence and its related sequences (for example, a sequence that responds to several related to its sending order as the request message, etc.) can be sent to the network device 10 again (or multiple times), according to the received The received response message adjusts the message type of the request message that is the same as the third binary sequence in the communication model.

For another example, a third binary sequence constructed according to the inferred meaning of at least one field of the request message in the communication model, and when the received response message is inconsistent with the inferred response message according to the communication model, the A plurality of fourth binary sequences are constructed based on the inferred meaning of at least one field of the request message, and the network device 10 adjusts at least one of the request messages in the communication model for these response messages of the fourth binary sequence. The inferred meaning of the field.

In this way, after the communication model is established, the communication model can also be verified by sending several request messages, and the communication model can be further adjusted to make the communication model more accurate and reliable.

In some embodiments, the analysis device 20 may provide the established communication model to a computing device for use. For example, the computing device can use the communication model to find errors and loopholes in the device, or use the communication model to establish a honeypot system, etc. Honeypot systems are designed to collect information about attackers by imitating vulnerable systems. Fig. 7 is a schematic diagram of a honeypot system according to an embodiment of the application. The honeypot system may include a traffic distributor 71, a traffic analyzer 72, and at least one physical device 73 and/or virtual device 74 for simulating the network device 10 to generate a response message.

Wherein, the traffic distributor 71 may distribute the received network traffic to each physical device 73 and/or virtual device 74 according to a preset distribution principle.

The physical device 73 and/or the virtual device 74 can use the communication model established in each embodiment to determine the response message corresponding to each request message in the received network traffic, and send the response message to the network.

The traffic analyzer 72 can analyze the request messages in the received network traffic, the response messages sent by the physical device 73 and/or the virtual device 74, and the further message interaction operations made by the external device on these response messages to obtain the attack Information about the party’s attack methods and methods.

It can be seen that by using the communication model established in each embodiment, the honeypot system can respond to external attacks, can confuse the attacker and make it think that the honeypot system is a real device, and can also get the attacker’s response to the device. Further attack operations, so as to obtain richer information of the attacker.

It can be seen from the above examples that the technical solutions of the embodiments can construct a communication model of the network device 10. By establishing a communication model as the description information of various messages processed by the network device 10, information about the communication behavior pattern of the network device 10 can be obtained. This process is completed by computing equipment, which reduces labor costs, and is fast and efficient. In addition, this solution can establish a communication model of the network device 10 without any known information about the format and content of the messages sent and received by the network device 10, and is especially suitable for the analysis and modeling of new devices.

The embodiment of the present application also provides a readable storage medium. The readable storage medium stores machine-readable instructions. When the machine-readable instructions are executed by a machine, the machine executes the method for establishing the communication model of the network device 10 described in any of the foregoing embodiments.

The readable medium stores machine-readable instructions, and when the machine-readable instructions are executed by the processor, the processor executes any of the foregoing methods. Specifically, a system or device equipped with a readable storage medium may be provided, and the software program code for realizing the function of any one of the above embodiments is stored on the readable storage medium, and the computer or device of the system or device The processor reads out and executes the machine-readable instructions stored in the readable storage medium.

In this case, the program code itself read from the readable medium can realize the function of any one of the above embodiments, so the machine readable code and the readable storage medium storing the machine readable code constitute the present application a part of.

Examples of readable storage media include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tape, Volatile memory card and ROM. Alternatively, the program code can be downloaded from the server computer or the cloud via the communication network.

Those skilled in the art should understand that the various embodiments disclosed above can be modified and modified without departing from the essence of the application. Therefore, the protection scope of this application should be defined by the appended claims.

It should be noted that not all steps and units in the above-mentioned processes and system structure diagrams are necessary, and some steps or units can be ignored according to actual needs. The order of execution of each step is not fixed and can be adjusted as needed. The device structure described in the foregoing embodiments may be a physical structure or a logical structure. That is, some units may be implemented by the same physical entity, or some units may be implemented by multiple physical entities, or may be implemented by multiple physical entities. Some components in independent devices are implemented together.

In the above embodiments, the hardware unit can be implemented mechanically or electrically. For example, a hardware unit or processor may include a permanent dedicated circuit or logic (such as a dedicated processor, FPGA or ASIC) to complete the corresponding operation. The hardware unit or processor may also include programmable logic or circuits (such as general-purpose processors or other programmable processors), which may be temporarily set by software to complete corresponding operations. The specific implementation mode (mechanical means, or dedicated permanent circuit, or temporarily set circuit) can be determined based on cost and time considerations.

The above are only preferred embodiments of this application, and are not intended to limit this application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this application shall be included in the protection scope of this application within.

Claims (20)

1. A method for establishing a communication model of a network device (10) is characterized in that it includes:

   Determine a plurality of different first binary sequences, where each first binary sequence corresponds to a request message;

   Sending the determined plurality of the first binary sequences to the network device (10);

   Acquiring, from the network device (10), response messages of a plurality of request messages corresponding to the first binary sequence, wherein each response message corresponds to a second binary sequence;

   Determining the law of each said second binary sequence changing with each said first binary sequence;

   The communication model of the network device (10) is established according to the rule.
2. The method according to claim 1, wherein the communication model includes at least one of the following:

   Correspondence between request message and response message;

   Speculative message type of request message;

   The inferred message type of the response message;

   The inferred meaning of at least one field in the request message;

   The inferred meaning of at least one field in the response message.
3. The method according to claim 2, wherein the correspondence between the request message and the response message comprises at least one of the following:

   One said first binary sequence corresponds to a plurality of said second binary sequences;

   A plurality of said first binary sequences corresponds to one said second binary sequence;

   One said first binary sequence corresponds to one said second binary sequence;

   One of the first binary sequences corresponds to an empty sequence;

   A plurality of the first binary sequences corresponds to an empty sequence.
4. The method according to any one of claims 1 to 3, wherein determining the law of the change of each of the second binary sequences with each of the first binary sequences comprises:

   Respectively intercepting a binary segment of a designated length from designated positions in a plurality of the first binary sequences;

   Determine the rule that the response message of the request message corresponding to the plurality of first binary sequences changes with the binary segment.
5. The method according to any one of claims 1 to 4, characterized in that establishing a communication model of the network device (10) according to the rule comprises:

   Determine each of the first binary sequence and/or each of the second binary sequence according to the law of the change of each of the second binary sequences with the components in each of the first binary sequences The inferred meaning of each component in the sequence;

   The communication model is established according to the inferred meaning of each component.
6. The method according to claim 5, wherein determining the inferred meaning of each component in each of the first binary sequence and/or each of the second binary sequence includes at least the following: One:

   When the plurality of the second binary sequences do not change with the first component in the corresponding plurality of the first binary sequences, the inferred meaning of the first component is determined as the message length and time , At least one of check code and value;

   When the plurality of the second binary sequences change with the corresponding first components in the plurality of the first binary sequences, and the degree of change does not exceed the preset first threshold, the first The inferred meaning of a component is determined as a numerical value;

   When the plurality of the second binary sequences change with the corresponding first components in the plurality of the first binary sequences, and the degree of change exceeds the first threshold, the first composition The meaning of part of the speculation is determined to be one or more of version information and type information;

   When a plurality of first components of the first binary sequence appear in the corresponding second binary sequence, determine the inferred meaning of the first component as a session identifier or a value;

   When the value of the second component in the plurality of the second binary sequences corresponding to the plurality of the first binary sequences continuously sent increases, the inferred meaning of the second component is determined as Counting information.
7. The method according to any one of claims 1 to 6, wherein sending the determined plurality of the first binary sequences to the network device (10) comprises at least one of the following:

   Sending one of the first binary sequences to the network device (10) multiple times;

   Sending the determined plurality of the first binary sequences to the network device (10) multiple times in different orders;

   Wherein, determining the law of each second binary sequence changing with each of the first binary sequences includes:

   Determine changes in multiple response messages corresponding to multiple transmissions of the same first binary sequence.
8. The method according to any one of claims 1-7, characterized in that, establishing a communication model of the network device (10) according to the rule comprises:

   Determine the inferred message type of each of the first binary sequence and/or each of the second binary sequence according to the law of each of the second binary sequences changing with each of the first binary sequences ；

   The communication model is established according to the inferred message type.
9. 8. The method according to claim 8, wherein each of the first binary sequences and/or each of the first binary sequences is determined according to the law that each of the second binary sequences changes with each of the first binary sequences The inferred message type of the second binary sequence includes:

   At least one of the following:

   When a plurality of the first binary sequences correspond to the same second binary sequence, and it is determined that the second binary sequence is an error prompt message, the plurality of first binary sequences corresponds to The request message is determined to be an invalid request message;

   When the plurality of second binary sequences are the same as the corresponding first binary sequence, determining the response message corresponding to the plurality of second binary sequences as echo messages;

   When a value of the second binary sequence is a Boolean value, the response message corresponding to the second binary sequence is determined as a status response message, and the request corresponding to the corresponding first binary sequence The message is determined to be a process request message;

   When multiple second binary sequences received after sending one of the first binary sequences are different, it is determined that the request message corresponding to the first binary sequence is a request message related to time or status ；

   When a response message of a request message corresponding to the first binary sequence is an empty sequence, the request message corresponding to the first binary sequence is determined as a message that triggers an unknown failure of the network device (10) .
10. The method according to any one of claims 1-9, further comprising:

    Sending a plurality of different third binary sequences to the network device (10) based on the established communication model of the network device;

    Adjusting the communication model according to the received response message corresponding to the third binary sequence.
11. A device (20) for establishing a communication model of a network device (10) is characterized in that it includes:

    A request determination module (210), configured to determine a plurality of different first binary sequences, where each first binary sequence corresponds to a request message;

    A sending module (220), configured to send the determined plurality of the first binary sequences to the network device (10);

    A response acquisition module (230), configured to acquire a plurality of response messages of the request message corresponding to the first binary sequence from the network device (10), wherein each response message corresponds to a second binary sequence sequence;

    A model building module (240) is used to determine the law of each of the second binary sequences changing with each of the first binary sequences, and establish a communication model of the network device (10) according to the law.
12. The device (20) according to claim 11, characterized in that the model establishment module (240) is configured to:

    Respectively intercepting a binary segment of a designated length from designated positions in a plurality of the first binary sequences;

    Determine the rule that the response message of the request message corresponding to the plurality of first binary sequences changes with the binary segment.
13. The device (20) according to any one of claims 11-12, wherein the model establishment module (240) is configured to:

    Determine each of the first binary sequence and/or each of the second binary sequence according to the law that each of the second binary sequence changes with each component in each of the first binary sequence The inferred meaning of each component in the sequence;

    The communication model is established according to the inferred meaning of each component.
14. The device (20) according to claim 13, wherein the model establishment module (240) is used for at least one of the following:

    When the plurality of the second binary sequences do not change with the first component in the corresponding plurality of the first binary sequences, the inferred meaning of the first component is determined as the message length and time , At least one of check code and value;

    When the plurality of the second binary sequences change with the corresponding first components in the plurality of the first binary sequences, and the degree of change does not exceed the preset first threshold, the first The inferred meaning of a component is determined as a numerical value;

    When the plurality of the second binary sequences change with the corresponding first components in the plurality of the first binary sequences, and the degree of change exceeds the first threshold, the first composition The meaning of part of the speculation is determined to be one or more of version information and type information;

    When a plurality of first components of the first binary sequence appear in the corresponding second binary sequence, determine the inferred meaning of the first component as a session identifier or a value;

    When the value of the second component in the plurality of the second binary sequences corresponding to the plurality of the first binary sequences continuously sent increases, the inferred meaning of the second component is determined as Counting information.
15. The device (20) according to any one of claims 11 to 14, wherein the sending module (220) is used for at least one of the following:

    Sending one of the first binary sequences to the network device (10) multiple times;

    Sending the determined plurality of the first binary sequences to the network device (10) multiple times in different orders;

    Wherein, the model establishment module is used for:

    Determine changes in multiple response messages corresponding to multiple transmissions of the same first binary sequence.
16. The device (20) according to any one of claims 11-15, wherein the model establishment module (240) is configured to:

    Determine the inferred message type of each of the first binary sequence and/or each of the second binary sequence according to the law of the change of each of the second binary sequences with each of the first binary sequences ；

    The communication model is established according to the inferred message type.
17. The device (20) according to claim 16, wherein the model establishment module (240) is used for at least one of the following:

    When a plurality of the first binary sequences correspond to the same second binary sequence, and it is determined that the second binary sequence is an error message, the request corresponding to the plurality of first binary sequences The message is determined to be an invalid request message;

    When the plurality of second binary sequences are the same as the corresponding first binary sequence, determining the response message corresponding to the plurality of second binary sequences as echo messages;

    When a value of the second binary sequence is a Boolean value, the response message corresponding to the second binary sequence is determined as a status response message, and the request corresponding to the corresponding first binary sequence The message is determined to be a process request message;

    When multiple second binary sequences received after sending one of the first binary sequences are different, it is determined that the request message corresponding to the first binary sequence is a request message related to time or status ；

    When a response message of a request message corresponding to the first binary sequence is an empty sequence, the request message corresponding to the first binary sequence is determined as a message that triggers an unknown failure of the network device (10) .
18. The device (20) according to any one of claims 11-17, further comprising: an adjustment module for

    Sending a plurality of different third binary sequences to the network device (10) based on the established communication model of the network device (10);

    The communication model is adjusted according to the response message corresponding to the third binary sequence obtained from the network device (10).
19. An apparatus (20) for establishing a communication model of a network device is characterized by comprising: a processor (250) and a memory (260), wherein:

    Computer readable instructions are stored in the memory (260), and the instructions can be executed by the processor (250) for implementing the network device (10) according to any one of claims 1 to 10 The establishment method of communication model.
20. A computer-readable storage medium storing computer-readable instructions, wherein the instructions are used to make the processor execute the establishment of the communication model of the network device (10) according to any one of claims 1-10 method.

Images