다중 프로토콜 분석을 위한 프로토콜 구조 및 시퀀스 탐색 방법 = Protocol Structure and Sequence Detection Method for Multi-Protocol Analysis

국문 초록 (Abstract)

본 논문에서는 악성 코드 및 해킹 시스템 등의 사이버 공격을 방지하기 위한 프로토콜 역공학에서 다중 프로토콜 분석을 위한 프로토콜 구조 및 시퀀스 탐색 방법을 제안한다. 다중 프토토콜 데이터는 2개 이상의 정의되지않은 프로토콜로 이루어진 데이터로 프로토콜의 분류가 필요하다. 본 연구에서는 다중 프로토콜 분류를 위해 계층적 군집화 방법을 사용하고 프로토콜 구조 및 시퀀스 탐색 알고리즘의 성능 및 계산복잡도의 향상을 위해 프로토콜 메시지의 payload를 제거하는 과정을 수행한다. 프로토콜 구조 및 시퀀스 탐색 알고리즘으로 sliding window를사용한 빈번한 시퀀스 탐색 알고리즘과 CSP (Contiguous Sequential Pattern) 알고리즘을 사용하여 제안하는 방법에 대한 성능평가를 수행하였다. Sliding window를 사용한 빈번한 시퀀스 탐색 알고리즘과 CSP 알고리즘 모두에서 계층적 군집화와 payload를 제거하는 과정을 모두 수행하면 향상된 결과를 얻을 수 있었다.

다국어 초록 (Multilingual Abstract)

This paper introduces a protocol structure and sequence detection method designed for multi-protocol analysis in the field of protocol reverse engineering, with the aim of mitigating cyber threats such as malware and system hacking. Multi-protocol data, involving two or more undefined protocols, requires effective protocol classification. To address this, our study employs a hierarchical clustering method for multi-protocol classification, enhancing the performance and reducing the computational complexity of the protocol structure and sequence detection algorithm by removing payload of messages. The proposed method is evaluated using both a frequent sequence detection algorithm with a sliding window and a Contiguous Sequential Pattern (CSP) algorithm for protocol structure and sequence detection. Results demonstrate that the inclusion of hierarchical clustering and payload removal in both the frequent sequence detection algorithm and the CSP algorithm leads to notable performance enhancements.

참고문헌 (Reference)

• 1 P. J. Rousseeuw, "Silhouettes : A graphical aid to the interpretation and validation of cluster analysis" 20 : 53-65, 1987
• 2 S. P. Chatzis, "Signal modeling and classification using a robust latent space model based on t distributions" 53 (53): 949-963, 2008
• 3 R. Sibson, "SLINK : An optimally efficient algorithm for the single-link cluster method" 16 (16): 30-34, 1973
• 4 Y. -H. Goo, "Protocol specification extraction based on contiguous sequential pattern algorithm" 7 : 36057-36074, 2019
• 5 Y. Huang, "Protocol revese-engineering methods and tools : A survey" 182 : 238-254, 2022
• 6 Y. Ye, "NETPLIER : Probabilistic network protocol reverse engineering from message traces" 1-18, 2021
• 7 R. Srikant, "Mining sequential patterns : Generalizations and performance improvements" 1-17, 1996
• 8 Y. Cheng, "Mean shitf, mode seeking, and clustering" 17 (17): 790-799, 1995
• 9 S. Lloyd, "Least squares quantization in PCM" 28 (28): 129-137, 1982
• 10 Z. Xu, "Learning types of binaries" 430-446, 2017
• 11 X. Wang, "IPART : An automatic protocol reverse engineering tool based on global voting expert for industrial protocols" 35 (35): 376-395, 2020
• 12 K. Anastasis, "ICSREF : A framework for automated reverse engineering of industrial control systems binaries"
• 13 R. Agrawal, "Fast algorithms for mining association rules" 1215 : 487-499, 1994
• 14 A. Moser, "Exploring multiple execution paths for malware analysis" 231-245, 2007
• 15 A. V. Aho, "Efficient string matching : An aid to bibliographic search" 18 (18): 333-340, 1975
• 16 O. Or-Meir, "Dynamic malware analysis in the modern era—A state of the art survey" 52 (52): 1-48, 2019
• 17 B. D. Sija, "A survey of automatic protocol reverse engineering approaches methods and tools on the inputs and outputs view" 2018 : 2018
• 18 신강식 ; 정동재 ; 최민지 ; 조호묵, "A study protocol reverse engineering research trend and construction of optimal environment for malware analysis" 32 (32): 175-186, 2021
• 19 M. Ester, "A density-based algorithm for discovering clusters in large spatial databases with noise" 96 (96): 226-231, 1996