APT木马网络协议逆向自动化分析

摘要

With the increasing demand for network security,the requirements for the analysis of remote control Trojan in APT attacks are also constantly increasing.Correspondingly,various methods and tools for analyzing unknown network protocols appear.In this paper,we introduced several existing methods of unknown network protocol reverse,and draw on the advantages of the existing methods.An improved method based on message data Tokenization,multiple sequence alignment and agglomerative hierarchical clustering for APT Trojan network protocol is proposed.%随着网络安全需求的不断提升,对于高级持续性威胁APT(Advanced Persistent Threat)攻击中的远程控制木马的分析的要求也不断提高,也相应地出现各种分析未知网络协议的方法与工具.介绍现有的几种未知网络协议逆向的方法,再吸取现有方法中的优点,提出一种改进的基于报文数据Token化、多序列比对与凝聚型层次聚类的针对APT木马网络协议逆向的方法.