KR102014234B1 - Method and Apparatus for automatic analysis for Wireless protocol - Google Patents

Abstract

Disclosed are an automatic wireless protocol analysis method and an apparatus therefor. According to an embodiment of the present invention, a wireless protocol analyzer may comprise: a preprocessing unit for extracting bit stream data from the collected wireless signal and classifying a session in which a message is received based on the bit stream data; a message distance calculation unit configured to measure a distance between the classified messages and generate a linkage matrix for clustering; and a cluster processing unit for clustering the message based on the linkage matrix.

Description

Wireless protocol automatic analysis method and device therefor {Method and Apparatus for automatic analysis for Wireless protocol}

The present invention relates to a method and an apparatus therefor for automatically analyzing a wireless protocol.

The contents described in this section merely provide background information on the embodiments of the present invention and do not constitute a prior art.

In the related art, it is determined whether the collected packets are packets according to a previously defined protocol or not, and if the packet is according to a new type of protocol, the user generates a definition file of the corresponding protocol and outputs a protocol analysis result. Techniques for analyzing this protocol are described in Korean Patent Registration No. 10-1466017.

However, in the conventional protocol analysis method, if the protocol is not defined in the past or the user does not know the structure of the protocol, there is a difficulty in protocol analysis.

Therefore, when it is necessary to analyze a packet for which the protocol structure cannot be specified, the protocol analysis cannot be processed by applying a conventional technique.

In addition, in order to analyze a wireless protocol, a process of converting an analog signal into a digital bit stream is required in a wireless signal collection step. In the conventional protocol analysis method, since it focuses on wired protocol analysis, no method for wireless signal analysis collection method is described. In other words, the wireless protocol uses messages in bits rather than bytes to minimize the memory used in the data sequence. Analyzing wireless protocols requires a technique for analyzing messages by analyzing bits rather than bytes.

The present invention is to provide a method for automatically analyzing a wireless protocol for extracting bit stream data from a radio signal and performing clustering by measuring a distance between messages based on bit stream data, and an apparatus therefor.

According to an aspect of the present invention, a wireless protocol analyzer for achieving the above object comprises a pre-processing unit for extracting the bit stream data from the pre-collected radio signal, and classifies the session in which the message is received based on the bit stream data; A message distance calculator configured to measure a distance between the classified messages and generate a linkage matrix for clustering; And a clustering processor that clusters the messages based on the connection matrix.

In addition, according to another aspect of the present invention, a wireless protocol analysis method for achieving the above object is a pre-processing to extract the bit stream data from the pre-collected radio signal, and to classify the session in which the message is received based on the bit stream data step; A message distance calculation step of measuring a distance between the classified messages to generate a linkage matrix for clustering; And a clustering processing step of performing clustering on the message based on the connection matrix.

As described above, the present invention has an effect of performing an analysis on a wireless transmission / reception protocol using a bit stream.

In addition, the present invention has the effect that can be efficiently performed for the wireless protocol of which the structure of the protocol is unknown.

In addition, the present invention has an effect that can efficiently analyze the message by automating the experiential part that needs to be changed by the user in the process of analyzing the protocol.

In addition, the present invention has the effect of reducing the mistakes caused by the user by reducing the portion of the user intervention and automation.

In addition, the present invention has the effect that the user can quickly find the variable through the analysis of the protocol to analyze the protocol rather than testing the variable by changing the variable directly when the user wants to find the optimal value.

1 is a block diagram schematically showing a protocol automatic analysis system according to an embodiment of the present invention.
2 is a block diagram schematically illustrating a protocol automatic analyzer according to an embodiment of the present invention.
3 is a flowchart illustrating a protocol automatic analysis method according to an embodiment of the present invention.
4 is a view for explaining the operation of the preprocessor of the protocol automatic analyzer according to an embodiment of the present invention.
5 is a view for explaining the operation of the message distance calculation unit of the protocol automatic analyzer according to an embodiment of the present invention.
6A and 6B are diagrams for describing an operation of a message distance calculator of a protocol automatic analyzer according to an exemplary embodiment of the present invention.
7 is a view for explaining the operation of the message distance calculation unit of the protocol automatic analyzer according to an embodiment of the present invention.
8 is a view for explaining the clustering processing unit operation of the protocol automatic analyzer according to an embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In describing the present invention, when it is determined that the detailed description of the related well-known configuration or function may obscure the gist of the present invention, the detailed description thereof will be omitted. In addition, the following will describe a preferred embodiment of the present invention, but the technical idea of the present invention is not limited thereto and may be variously modified and modified by those skilled in the art. Hereinafter, with reference to the drawings will be described in detail the radio protocol automatic analysis method and apparatus therefor proposed in the present invention.

The present invention relates to a technique for automatically analyzing the structure of a wireless transmit / receive protocol. In the case of a wireless transmit / receive protocol, a message in units of bits rather than bytes is used to minimize memory used in a data sequence. In the case of the conventional wire protocol analyzer, it is necessary to analyze the data in byte unit. To solve this problem in the wireless protocol analyzer, we classify using only the bit unit calculation and minimize the artificial work.

In the present invention, the message collection time interval is considered as a method for automating an experiential part in which a message is analyzed bit by bit and a parameter is changed by human intervention to analyze a protocol in consideration of a wireless environment. The purpose of the present invention is to automatically analyze a private protocol bit by bit using these techniques to cluster similar messages.

The present invention is preferably applied to the military field to automatically analyze a wireless protocol, but is not necessarily limited thereto, and is included in a wireless intrusion prevention system (WIPS) to classify normal wireless packets and malicious wireless packets. It can be used as software for analyzing malicious packets.

1 is a block diagram schematically showing a protocol automatic analysis system according to an embodiment of the present invention.

The protocol automatic analysis system 100 according to the present embodiment includes a wireless signal collection device 110 and a protocol automatic analyzer 120. The protocol automatic analysis system 100 of FIG. 1 is in accordance with one embodiment, and not all of the blocks shown in FIG. 1 are required components, and in other embodiments, some blocks included in the protocol automatic analysis system 100 are added. , Can be changed or deleted.

The protocol automatic analysis system 100 is divided into a wireless signal collecting device 110 performing a step of collecting a wireless signal and a protocol automatic analyzer 120 performing a step of analyzing a protocol with a bit stream extracted from the collected wireless signal. do. The protocol automatic analysis system 100 may perform protocol automatic analysis for IEEE 802.11, which is a representative protocol used in a wireless environment, but is not necessarily limited thereto.

The radio signal collecting device 110 includes an antenna 112, a demodulator 114, and an analog to digital converter 116. The antenna 112 is requested to one side of the radio signal collecting device 110 to perform a role of receiving a radio signal. The antenna 112 may be a military system (microwave, microwave, etc.) antenna, but is not limited thereto, and may be implemented in various forms as long as it can receive a radio signal.

The demodulator 114 collects radio signals of a predetermined band among the received radio signals. Here, the demodulator 114 preferably collects a radio signal of a predetermined band by using a software defined recorder (SDR) such as GNURadio, but is not necessarily limited thereto.

The analog to digital converter 116 converts an analog radio signal into a digital bit stream.

The radio signal collecting device 110 according to the present embodiment may be implemented using a device such as a software defined recorder (SDR) and software for demodulating and demodulating a radio signal such as GNURadio.

First, based on the analog signal collected from the antenna of the SDR device, the signal is demodulated by GNURadio and converted into a bit stream. The demodulation technique can be any communication standard or technology, and the final step is to simply send the bit information from the radio signal acquisition part to the next diagram.

The radio signal collecting device 110 may collect radio signals by using a hardware network adapter including a communication modulation and demodulation module or by using an RF transceiver such as Universal Software Radio Peripheral (USRP) capable of data processing in software. It doesn't happen.

GNURadio is open source software provided by the Unix development environment. GNURadio can be used with USRP to create your own modules in software. The code for demodulating the analog signal received from the antenna of the USRP device was developed using GNURadio.

The protocol automatic analyzer 120 includes a preprocessor 210, a message distance calculator 220, and a clustering processor 230.

The preprocessor 210 extracts additional data necessary for message clustering and classifies the extracted data in packet units.

The message distance calculator 220 measures the distance between the messages. The message distance calculator 220 may calculate the similarity between the messages by using a Needleman-Wunsch algorithm or a Waterman algorithm, and measure the distance between the messages.

The clustering processor 230 clusters the messages with high similarity based on the distance between the messages. The clustering processor 230 performs clustering of messages having the highest similarity using a hierarchical clustering algorithm, such as an unweighted pair group method with arithmetic mean (UPGMA), based on the calculated distance between the messages. .

The protocol automatic analyzer 120 analyzes the data packet of the physical layer. The protocol automatic analyzer 120 may analyze the protocol by using an automatic protocol reversing engineering (APRE) technique, but is not limited thereto.

Although most of the prior art deals mainly with communication in the upper layer of the OSI Layer such as HTTP, FTP, etc., the protocol automatic analyzer 120 of the present invention mainly deals with data packets of the physical layer. Detailed description of the protocol automatic analyzer 120 will be described with reference to FIG. 2.

2 is a block diagram schematically illustrating a protocol automatic analyzer according to an embodiment of the present invention.

The protocol automatic analyzer 120 according to the present embodiment includes a preprocessor 210, a message distance calculator 220, and a clustering processor 230. The protocol automatic analyzer 120 of FIG. 2 is in accordance with one embodiment, and not all of the blocks shown in FIG. 2 are required components. In another embodiment, some blocks included in the protocol automatic analyzer 120 may be added or changed. Or may be deleted.

The preprocessor 210 refines the data obtained from the radio signal and extracts additional data necessary for message clustering. The preprocessor 210 according to the present embodiment includes a bit stream data extractor 212, a time information extractor 214, and a data session classifier 216.

The bit stream data extractor 212 converts the data obtained from the collected radio signals into bit stream data in units of bits in order to analyze the units in bits. The bit stream data extractor 212 may purify or extract predetermined important data from the bit stream data.

The time information extractor 214 extracts and stores time information at the time point at which the bit stream data is collected. In other words, the time information extracting unit 214 extracts and stores time information when the message arrives in bits.

The data session classifier 216 classifies sessions based on the extracted time information. Since wireless device communication has a similar communication time for each session, a session in which a message is received can be automatically classified based on the extracted time information.

Time clustering is an important consideration in clustering messages. Referring to FIG. 4 showing the time at which the messages were received, it can be seen that transmission and reception between wireless devices are repeated after a series of time after the messages are continuously transmitted and received. That is, the more likely messages are in the same session, the more likely they are to be sent and received, and the more different sessions are, the less relevant they are to messages. Therefore, the message distance calculator 220 of the present invention may assign weights according to time intervals when calculating the distance between messages. Information on performance improvement using weights for packet reception time intervals is described in the message distance calculator 220.

The message distance calculator 220 searches for a fitting variable based on the bit stream data and time information, and measures a distance between messages using the fitting variable. The message distance calculator 220 includes a fit variable search unit 222, a distance calculator 224, and a connection matrix generator 226.

The adaptive variable search unit 222 searches for a variable used for calculating the message distance for analyzing the protocol in bits. In this case, the fit variable search unit 222 may search for a fit variable used for calculating a message distance using the Monte Carlo technique, but is not limited thereto. Here, the algorithm used for calculating the message distance may be a Needleman-Wunsch algorithm.

Since the core of the present invention is a technique for proposing a bit-by-bit protocol analysis, the fit variables have a great influence on the clustering performance. In other words, since the result of calculating the message distance may vary depending on how the weights of the fit variables are placed, the present invention searches for the fit variables without artificially determining the value of the weight classifying the message with the highest accuracy using the Monte Carlo technique. do. For example, the fit variable search unit 222 assumes a matching award (10) obtained when the sequence characters of two messages match, and mismatch-penalty and gap-penalty. ) Can search for fitted variables by randomly extracting a value between 0 and 10.

As shown in FIG. 5, the fit variable search unit 222 finds two values having the highest accuracy using the Monte Carlo technique. The highest point of the graph shown in FIG. 5 has the highest accuracy (Z) of 90% when Mismatch-penalty (X) is 0.9 and when Gap-penalty (Y) is 5.1. Using the Monte Carlo technique, this highest accuracy fit can be found automatically.

The distance calculator 224 measures the distance between the messages based on the bit stream data and the time information obtained by the preprocessor 210. Here, the distance calculator 224 preferably compares the distance between sequences using the Needleman-Wunsch algorithm, which is one of sequence distance calculation algorithms, but is not necessarily limited thereto.

In the following description, it is assumed that the distance between messages is measured by applying the Needleman-Wunsch algorithm. When the distance is measured using the Needleman-Wunsch algorithm, several dictionary variables must be set in order to calculate the distance between messages, and the variable setting is processed by the fit variable search unit 222. A detailed process will be described with reference to FIG. 6A.

As shown in FIG. 6A, an alignment technique using a Needlmen-Wunsch algorithm will be described using two sequences 70832F65BD867AD200 and 708300D200 as an example.

The fit variable search unit 222 first generates a first matrix (matrix F) having a size corresponding to each message length. If we define the values of elements in row i, column j of the first matrix as F _{i, j} , the two sequences are m1 [i], m2 [j], and the similarity function is S (x, y), Is defined as:

(F _{i, j} : value of element of row i column j of the first matrix (matrix F), S: similarity function, m: message (sequence), d: arbitrary fixed value (constant))

Here, d is a fixed value, and the fixed value may be defined as a gap-penalty. Gap-penalty refers to the penalty of a value being pushed when aligning two sequences. The function S is expressed as a score quantifying the similarity when matched, which can be defined as shown in [Equation 2].

(S: similarity function, v: matching compensation function, e: compensation value when two message values are the same, f is penalty value when two message values are wrong)

In this case, e is the same concept as compensation when two message values are the same, and f is a penalty when wrong. Here, the score difference when the two message values are different may be defined as a mismatch-penalty.

In order to align using the Needleman-Wunsch algorithm, pre-fit variables such as mismatch-penalty and gap-penalty must first be set.

In the finally obtained matrix, a path is formed by starting from the largest value in the matrix and moving to the largest value (diagonal case in the same case) of the left, upper, and diagonal values as shown in the diagonal pattern portion of FIG. 6A. In other words, find the alignment with the least penalty.

Referring to the actual example as shown in Figure 6b as follows.

Referring to FIG. 6B, the first region 610 is defined as a penalty due to a gap generated during alignment, and the second region 620 is mismatched with each other. It is defined as the penalty incurred. The scores for these parts are defined to show differently aligned results with the Needleman-Wunsch algorithm.

In the present invention, a weight using a time interval may be additionally applied to improve performance.

In other words, the distance calculator 224 may set the distance so that the distance becomes longer as the time interval becomes longer by applying Equation 3 to the result value obtained using the Needleman-Wunsch algorithm. Here, the distance calculator 224 corresponds to an important part for the automated analysis when compared with other conventional techniques. In other words, weights are assigned to the similarity evaluation between packets according to time intervals so that sessions are automatically separated.

(G: Half-Gaussian distribution, t [i], t [j]: time the message was collected, μ: 0 (preset constant))

Here, G follows a half-normal distribution and the detailed formula is shown in [Equation 4].

((G (y): Half-Gaussian distribution, σ: 3 (preset constant)))

The G (y) function of Equation 4 denotes a Half-Gaussian distribution. Specifically, the G (y) function gives a weight that gradually decreases with distance and multiplies the distance calculation between sequences. The graph for this G (y) function is shown in FIG.

When the distance calculation unit 224 according to the present invention applies a weighting function for the distance to the calculated alignment score, packets existing in a close time are automatically bundled. 7 (b) shows an alignment score without applying a weight function for distance, and FIG. 7 (c) shows an alignment score with a weight function for distance.

That is, according to the distance calculator 224 according to the present invention, the clustering object having a long time difference can be automatically removed according to the weighting function of the distance, so that the cluster can be inferred without artificial session separation.

Hereinafter, the operation of the message distance calculator 220 will be described in detail. Here, the message distance calculator 220 is assumed to measure the distance between messages using the Needleman-Wunsch algorithm, but is not necessarily limited thereto.

The message distance calculator 220 needs a measure for measuring the similarity of the messages in order to cluster similar messages. For example, the message distance calculator 220 calculates the distance of the message by applying a Needleman-Wunsch algorithm and a weighting technique based on a time interval. Here, the Needleman-Wunsch algorithm is one of the representative Sequence Alignment algorithms.

The message distance calculation unit 220 performs a sequence alignment to closely match the two sequences as much as possible to compare messages having two different sequences, and then mismatches to quantitatively compare the similarities of the two messages. A penalty, a gap penalty, and a matching award are set, and the similarity between the messages is calculated using the set mismatch penalty, the gap penalty, and the matching value.

The mismatch penalty value is a value that is given when there are different values. A mismatch penalty value is set to have a lower value when the message is not similar.

The message distance calculator 220 may generate a space in the sorting process when the lengths of the messages are different. The gap penalty value is calculated when there is a space in the alignment process. It is set to a negative value so that each time a space is added, it has a lower similarity value.

Matching award assigns a value when two values have the same value so that the same message has a higher similarity value.

The Needleman-Wunsch algorithm consists of comparing two sequences to construct a matrix and finding the best alignment.

The message distance calculator 220 configures a first matrix (matrix F) by measuring similarity for each bit of the message in order to calculate an optimal alignment of the two messages m ₁ and m ₂ . That is, the size of the first matrix (matrix F) is composed of values of length (m ₁ ) + 1 by length (m ₂ ) + 1.

A second matrix (matrix Ptr) showing an optimal alignment with the first matrix (matrix F) is defined as in Equations 5 to 8. Here, g means a gap penalty value, e means a matching award, and f means a mismatch penalty value.

(F _{i, j} : the value of the element in row i column j of the first matrix (matrix F), S: matching compensation function, e: compensation value when two message values are equal, f is penalty when two message values are wrong) (penalty) value, g: gap penalty, Ptr _{i, j} : second matrix (matrix Ptr), Diag: diagonally shifted to the upper left, Left: shifted left, Up: shifted upwards)

The message distance calculator 220 may align two messages using a second matrix (matrix Ptr) indicating an optimal alignment.

The message distance calculation unit 220 recursively starts from the last element of the second matrix (matrix Ptr) and moves upwardly when the element value is Diag and upwards when the element value is Left and upwards when the element value is Left. Find the best alignment path. In other words, the sorting of two messages proceeds in the reverse order of the message. If the element value is Diag in the process of finding the optimal path, the bits of the sequence have the same value. If the element value is Left, the left sequence of the order This means that the message in has a gap. If the value of the element is Up, the message in the upper sequence of the sequence has a gap. As described above, when the message distance calculator 220 arrives at the first element of the second matrix (matrix Ptr) while moving recursively, the alignment is completed.

Thereafter, the message distance calculating unit 220 determines that the two messages (m ₁ , m ₂ ) are sorted using the Needleman-Wunsch algorithm (m ₁ ', m ₂ ') and the time when the two messages were collected (t [ m ₁ ], t [m ₂ ]) to calculate the distance of the two messages. Message calculation section 220 into two messages, sorted _{(m 1 ', m 2'} ) m 1 ' and m _2' similarity to the value obtained by dividing the number of bits having the same value (Identity) from the total message length of the define.

The message distance calculation unit 220 calculates the probability density function f (x) as shown in Equation 9 when the time weight w is given so that the longer the time difference between the two messages is collected, the lower the similarity value is. Can be defined.

(f (x): probability density function, w: time weight)

When the probability density function f (x) is as above, the distance d (m ₁ , m ₂ ) of two messages (m ₁ , m ₂ ) is calculated as shown in Equation 10.

(d (m ₁ , m ₂ ): weighted distance of two messages (m ₁ , m ₂ ), identity: similarity)

Accordingly, the message distance calculator 220 has a smaller distance value because the two messages are similar, and the distance between the two messages is closer, and the distance between the two messages is longer as the two messages are different, and thus a large distance value is calculated.

For example, given a message m ₁ = 10010 and m ₂ = 110 consisting of a bit stream, the first matrix (matrix F) and the second matrix (matrix Ptr) are shown in Table 1 and Table 2, respectively. It is composed. Here, it is assumed that a gap penalty value g is -5, a matching award e is 10, and a mismatch penalty value f is -1.

Table 1 shows a first matrix (matrix F) for m ₁ = 10010 and m ₂ = 110.

The shaded elements in Table 2 indicate the optimal alignment path for the two messages.

According to [Table 2], the alignment results of the two messages m ₁ and m ₂ calculated by the message distance calculator 220 are m ' ₁ = 10010 and m' ₂ = 1--10, respectively. The sorting result of the two messages m ₁ and m ₂ is 5, and the number of bits common to m ' ₁ and m' ₂ is 3, so the identity is 3 = 5/5. In addition, when the time when two messages were collected is t [m ₁ ] = 0.1, t [m ₂ ] = 0.2 and time weight w = 10, the distance value d (m ₁ , m ₂ ) of the two messages = 1.66 Has

The link matrix generation unit 226 calculates the distance between the messages in each session, and the distance between all the messages is obtained in a matrix form, which may be defined as a linkage matrix (matrix D). In other words, the connection matrix generator 226 may configure a connection matrix by calculating a distance between messages for all possible message pair combinations in all collected data.

The clustering processor 230 processes the clustering by applying a hierarchical clustering algorithm based on the linkage matrix D generated by the message distance calculator 220. The clustering processor 230 includes a distance cluster processor 232, a tree tree generator 234, and a message cluster 236.

The distance clustering unit 232 clusters similar messages using a hierarchical clustering algorithm based on a linkage matrix (D) of the message distance calculated by the message distance calculating unit 220. Perform

The phylogenetic tree generation unit 234 generates a tree diagram indicating the order in which the objects are combined hierarchically clustered. The phylogenetic tree generation unit 234 may indicate the order in which the entities are combined in the form of a dendrogram.

The message cluster unit 236 sets a cluster level by referring to the generated dendrogram and performs a message cluster according to the set cluster level.

Hereinafter, the operation of the clustering processor 230 will be described in detail.

The clustering processor 230 performs clustering between similar messages using a hierarchical clustering algorithm. Here, the hierarchical clustering algorithm is an algorithm that integrates individual entities into hierarchically similar entities or groups by using a hierarchical tree model. The clustering processor 230 may cluster similar messages by applying an Unweighted Pair Group Method with Arithmetic Mean (UPGMA) algorithm. The UPGMA algorithm is one of hierarchical clustering algorithms that hierarchically clusters using the average distance between all pairs of objects in two clusters.

Given two clusters x and y, n _a is the number of objects in cluster a, and a _i is the i th entity of cluster a, the distance dist (x, y) of two clusters x, y is 11].

(x, y: two clusters, dist (x, y): distance of two clusters x, y, n _x : number of objects in cluster x, n _y : number of objects in cluster y, d ( m ₁ , m ₂ ): the distance of two messages (m ₁ , m ₂ ))

The clustering processor 230 may check the clusters formed in stages using the dendrogram and check the distance of the formed clusters. The clustering processor 230 may set a threshold value for the distance value of the cluster formed by using the dendrogram, and determine the final cluster level based on the set threshold value.

3 is a flowchart illustrating a protocol automatic analysis method according to an embodiment of the present invention.

The wireless signal collecting device 110 collects a wireless signal (S310). Step S310 collects a signal of a desired radio signal band using SDR (Software Defined) such as GNURadio, and converts the analog signal into a digital bit stream. Step S310 corresponds to an operation performed by the radio signal collecting device 110.

The protocol automatic analyzer 120 performs preprocessing of the collected radio signals (S320). In operation S320, additional data extraction required for message clustering and division into packet units are performed. Here, step S320 extracts time information from the collected bit stream data, and classifies a data session according to time. Step S320 corresponds to an operation performed by the preprocessor 210 of the protocol automatic analyzer 120.

The protocol automatic analyzer 120 calculates a distance between messages based on the preprocessing result (S330). Step S330 may calculate the similarity between messages using the Needleman-Wunsch algorithm or the Waterman algorithm. Step S330 sets a variable to be used for calculating the message distance, calculates the distance between the messages using the Needleman-Wunsch algorithm or the Waterman algorithm, and calculates a linkage matrix (matrix D) for calculating the message distance between all collected messages. Create Step S330 corresponds to an operation performed by the message distance calculator 220 of the protocol automatic analyzer 120.

The protocol automatic analyzer 120 performs clustering of similar messages based on the calculated distance between the messages (S340). Step S340 processes the clusters of similar messages using a hierarchical clustering algorithm based on the calculated distance. Step S340 clusters similar messages using a hierarchical clustering algorithm such as UPGMA using the calculated distance between the messages, generates a dendrogram based on the clustered result, and a threshold for the message cluster level. Determining and performing message clustering. Step S340 corresponds to an operation performed by the clustering processor 230 of the protocol automatic analyzer 120.

In FIG. 3, the steps are described as being sequentially executed, but are not necessarily limited thereto. In other words, since the steps described in FIG. 3 may be applied by changing or executing one or more steps in parallel, FIG. 3 is not limited to the time series order.

The protocol automatic analysis method according to the present embodiment described in FIG. 3 may be implemented in an application (or program) and recorded on a recording medium readable by a terminal device (or computer). The recording medium which an application (or program) for implementing the protocol automatic analysis method according to the present embodiment is recorded and the terminal device (or computer) can read is any kind of recording device that stores data that can be read by the computing system. Or media.

4 is a view for explaining the operation of the preprocessor of the protocol automatic analyzer according to an embodiment of the present invention.

Referring to FIG. 4, it can be seen that the transmission and reception between wireless devices is repeated after the message is continuously transmitted and received again after a series of time. That is, the more likely messages are in the same session, the more likely they are to be sent and received, and the more different sessions are, the less relevant they are to messages. Therefore, the message distance calculator 220 of the present invention may assign weights according to time intervals when calculating the distance between messages.

5 is a view for explaining the operation of the message distance calculation unit of the protocol automatic analyzer according to an embodiment of the present invention.

The message distance calculator 220 of the present invention searches for the appropriate variables without artificially determining the value of the specific gravity that classifies the message with the highest accuracy using the Monte Carlo technique. For example, the message distance calculator 220 assumes a matching award obtained when two sequence characters of two messages match 10, and mismatch-penalty and gap-penalty. ) Can search for fitted variables by randomly extracting a value between 0 and 10.

Referring to FIG. 5, the message distance calculator 220 finds two values having the highest accuracy using the Monte Carlo technique. The highest point of the graph shown in FIG. 5 has the highest accuracy (Z) of 90% when Mismatch-penalty (X) is 0.9 and when Gap-penalty (Y) is 5.1. Using the Monte Carlo technique, this highest accuracy fit can be found automatically.

8 is a view for explaining the clustering processing unit operation of the protocol automatic analyzer according to an embodiment of the present invention.

The clustering processor 230 may cluster the messages with close distances. 8 shows a clustering result of each message in a dendrogram.

As shown in FIG. 8, the index on the x-axis represents the sequence number of each message, and the value on the y-axis represents the distance between each message obtained by the Needleman-Wunsch algorithm. Each cluster can be seen clustered in order of closest distance.

The hierarchical clustering algorithm used in the clustering processor 230 may be any hierarchical algorithm, and represents a result of clustering using an unweighted pair group method with arithmetic mean (UPGMA) algorithm. The clustering processor 230 finally selects the cluster that is determined to exist at a predetermined distance based on the threshold value in the finally obtained dandogram, that is, the tree tree graph.

In the conventional case, since the semantic information of the byte is used, it is not suitable for a wireless communication protocol for communicating a bit-by-bit message. However, in the case of the present invention, the performance can be solved only by comparing the bit-wise. have.

The above description is merely illustrative of the technical spirit of the embodiments of the present invention, and those skilled in the art to which the embodiments of the present invention pertain various modifications without departing from the essential characteristics of the embodiments of the present invention. Modifications may be possible. Therefore, the embodiments of the present invention are not intended to limit the technical spirit of the embodiments of the present invention, but to describe, and the scope of the technical spirit of the embodiments of the present invention is not limited by these embodiments. The protection scope of the embodiments of the present invention should be interpreted by the following claims, and all technical ideas within the equivalent scope should be interpreted as being included in the scope of the embodiments of the present invention.

100: protocol automatic analysis system
110: radio signal collection equipment 112: antenna
114: demodulator 116: analog-to-digital converter
120: protocol automatic analyzer 210: preprocessor
220: message distance calculation unit 230: clustering processing unit

Claims (12)

An apparatus for automatically analyzing wireless protocols,
A preprocessor extracting bit stream data from the collected wireless signal and classifying a session in which a message is received based on the bit stream data;
A message distance calculator configured to measure a distance between the classified messages and generate a linkage matrix for clustering; And
A clustering processor configured to perform clustering on the message based on the connection matrix;
The preprocessor may include: a bit stream data extracting unit converting the wireless signal collected through the wireless signal collecting device into bit stream data in units of bits; A time information extracting unit for extracting time information of the time point at which the bit stream data is collected; And a data session classification unit for automatically classifying a session in which a message is received based on the bit stream data and the time information.
The message distance calculator measures bit similarity of each of two messages having two different sequences among the messages, generates a first matrix (matrix F) having a size determined based on the length of each message, Search for an alignment path according to whether bits of each of the two messages are identical in one matrix to generate a second matrix (matrix Ptr), wherein the two messages are aligned according to the alignment path of the second matrix (matrix Ptr). Computing a similarity between the two messages based on the length of the message and the number of common bits included in the sorting result for, and calculates the distance between the messages by applying the time weight based on the time information between the messages to the similarity,
The message distance calculator generates the connection matrix by calculating the distance between the messages between all message pairs that can be combined in the message. delete delete The method of claim 1,
The message distance calculation unit,
In order to compare two messages having two different sequences, a sequence alignment is performed, and then a mismatch penalty and a gap penalty are used to quantitatively compare the similarities of the two messages. and setting at least one of a penalty and a matching award, and calculating the alignment result using at least one of the set mismatch penalty, the gap penalty, and the matching value. The method of claim 1,
The message distance calculation unit,
The similarity is measured for each bit of the message to generate a first matrix (matrix F), and the second matrix (matrix Ptr) for optimal alignment is generated by performing the alignment between the messages in the reverse order of the messages according to a predefined rule. And calculating the alignment result based on the first matrix (matrix F) and the second matrix (matrix Ptr). The method of claim 1,
The message distance calculation unit,
Probability density function by setting the value obtained by dividing the number of bits having the same value between the two messages from the total message lengths of the two messages corresponding to the sorting result as the identity, and applying the similarity and the time information ( and f (x)) to calculate the distance between the messages. The method of claim 6,
The message distance calculation unit,
And the probability density function (f (x)) is defined by applying a time weight (w) so that the longer the time difference between two messages is collected, the lower the similarity value. The method of claim 1,
The clustering processing unit,
Clustering is performed by using a hierarchical clustering algorithm based on a linkage matrix (D), and a set cluster is generated by generating a dendrogram indicating the order in which the messages are combined. And finally clustering the messages according to the level. In the method for automatically analyzing a wireless protocol,
Extracting bit stream data from the collected wireless signal and classifying a session in which a message is received based on the bit stream data;
A message distance calculation step of measuring a distance between the classified messages to generate a linkage matrix for clustering; And
And a clustering processing step of performing clustering on the message based on the connection matrix.
The preprocessing step may include: a bit stream data extraction step of converting the wireless signal collected through the wireless signal collection device into bit stream data in units of bits; A time information extraction step of extracting time information at the time point at which the bit stream data is collected; And a data session classification step of automatically classifying a session in which a message is received based on the bit stream data and the time information.
The message distance calculating step may measure similarity for each bit of each of two messages having two different sequences among the messages, generate a first matrix (matrix F) having a size determined based on the length of each message, and Search for an alignment path according to whether bits of each of the two messages are identical in the first matrix to generate a second matrix (matrix Ptr), and the two aligned according to the alignment path of the second matrix (matrix Ptr) The similarity between the two messages is calculated based on the length of the message and the number of common bits included in the sorting result for the message, and the distance between the messages is calculated by applying a time weight based on time information between the messages to the similarity,
In the message distance calculating step, the connection matrix is generated by calculating the distance between the messages between all pairs of messages that can be combined in the message. delete delete The method of claim 9,
The message distance calculation step,
The similarity is measured for each bit of the message to generate a first matrix (matrix F), and the second matrix (matrix Ptr) for optimal alignment is generated by performing the alignment between the messages in the reverse order of the messages according to a predefined rule. And calculating the sorting result based on the first matrix (matrices F) and the second matrix (matrices Ptr).

Images