Chinese Journal of Network and Information Security ›› 2018, Vol. 4 ›› Issue (12): 54-61.doi: 10.11959/j.issn.2096-109x.2018099

• Papers • Previous Articles     Next Articles

Analysis of communication data of mobile terminal based on protocol reversal

Mingyuan ZHANG1,Xinyu QI2(),Yubo SONG2,Rongrong GU2,Aiqun HU2,Zhenchao ZHU2   

  1. 1 The State Radio Monitoring Center Testing Center,Beijing 100041,China
    2 School of Cyber Science and Engineering South East University,Nanjing 211189,China
  • Revised:2018-11-28 Online:2018-12-01 Published:2018-12-30
  • Supported by:
    The National Natural Science Foundation of China(61601113);The Fundamental Research Funds for the Central Universities of China(2242017K40013)


The most problem in analysis of communication protocols and communication data for mobile terminals is that many mobile applications do not have the relevant public technical documents,and it is difficult to know the type of communication protocol it adopts.The instruction execution sequence analysis technique takes the instruction sequence executed by the program as a research object,and inversely infers the message format and the state machine to obtain the communication protocol.However,due to the incomplete collection of sequence information,the state machine infers that the inference is incomplete and cannot be effective.A novel protocol reverse scheme based on state machine comparison is proposed,which can be used for the forensics of mobile terminal communication data.The scheme first uses PIN for dynamical identification of the taint,and track it and analyzes the trajectory to obtain the message format.Secondly,the message clustering is performed on the basis of the message format to infer the protocol state machine.Finally,the LCS algorithm is used to compare the state machines to get a complete protocol state machine.This article tests and evaluates the scheme based on two types of application design experiments on the Android platform.The experimental results show that the results are both complete and real-time,and have practical value.

Key words: mobile terminal, data forensics, dynamic stain analysis, protocol reverse analysis, similarity comparison

CLC Number: 

No Suggested Reading articles found!