CN104360836B - Network protocol formalization description tool under Android system environment - Google Patents

Abstract

The invention relates to a network protocol formalization description tool under an Android system environment and belongs to the field of computer networks. The network protocol formalization description tool comprises a set of protocol description and analysis flows and a tool chain and comprises a network data packet capturing module under an Android environment, a protocol formalization description analysis module and a data packet content analysis module, and a protocol analysis result is finally displayed. The tool is specifically implemented by defining a formalization description language analysis flow and key function of a typical network protocol and by virtue of a flow and element definition of data packet content analysis and a key function definition. The network protocol formalization description tool is applied to the field of relevant research and application for real-time network condition analysis, protocol quality analysis and safety analysis under an Android operating system. A network data packet can be captured under a normal flow condition, the system is slightly influenced by program design, and the formalization description operation of a data packet protocol can be normally and smoothly completed.

Description

Procotol formalized description instrument under Android system environment

Technical field

The present invention relates to computer network field, more particularly to protocol engineering, Android operation system, procotol formalization Description aspect, the procotol formalized description instrument under espespecially a kind of Android system environment, under being a kind of Android system environment Procotol formalized description and analysis method, and protocol formal analysis method instrument based on this.

Background technology

ARIXTRA（Android）Operating system is the shifting of increasing income based on Linux platform that Google is announced in November, 2007 Dynamic operating system, using the framework of software stack layers, is broadly divided into three parts：Based on bottom is worked by linux kernel, by C languages Speech exploitation, provides only basic function；Intermediate layer includes function library and virtual machine, has C++ to develop；Upper strata is various application softwaries, By each company's self-developing.System construction drawing such as accompanying drawing 1.

The component of android system can be divided into following components：

（1）Critical applications（Applications）

Android system is issued together with a series of core application bags, including Email clients, SMS short message journeys Sequence, calendar, map, browser etc..

（2）Application framework

Developer can completely access the API framework that core application is used, and this design simplify component Reuse, any one application program can issue its functional device, and other programs can be used.Including regarding Figure, Content Provider, explorer etc..

（3）System operation storehouse

Including program library and Runtime Library, can by android system in different components use, there is provided JAVA is programmed Most of functions in language core storehouse.

（4）Linux kernel

The core system of Android depends on Linux2.6 kernels, such as safety, memory management, management of process, network association Negotiation driving model.Linux kernel also serves as the level of abstraction between hardware and software stack.

It is main comprising three kinds that Protocol Formal Models are commonly used：

（1）Finite state machine FSM

FSM is the basis of many formalization methods, and it can realize the combination and conversion with other forms method, and It is easy to be automatically obtained, therefore occupies critical role in formalized description.The protocol verification described based on FSM can by construction Realize up to tree.FSM simple, intuitives, but descriptive power is limited, therefore in the description of communication protocol, it usually needs it is carried out Extension and optimization.

（2）Petri network

Petri network is a kind of figure mathematical tool for being suitable for concurrent, asynchronous and distributed system description and analysis, at present Have become one of typical model of network protocol analysis and design.Petri network has in terms of the description and analysis of protocol system Many analytical technologies, such as approachability analysis, invariant, structural theory, Formal Language Theory etc..In order in different field Application, develop from basic petri net and the research of many extensions, including predicate/action Petri network, Time Petri Nets, with Machine Petri network etc..

（3）Communication process calculates CCS

CCS is the basis of process algebra, when one system of statement that can be strict or process are performed the timing of event with And the characteristic communicated between system.Can be with the property of tight algebraically calculation method indentification protocol, therefore it is also that computer leads to One of basic theories model of letter system.Will be comprising combination operators using extension rule, restriction rule and other algorithms Expression formula expand to the expression formula not comprising combination operators, can verify whether the system that multiple processes are combined has activity Property and safety.The logical structure for expressing one's gratitude and the timing of agreement for being capable of precision is had an advantage in that, but can not be intuitively Description nature of agreement.

Procotol formal description language be typically based on strict mathematical method, and have strict grammer and Semantic definition, can accurately, completely express function, performance and the behavior of agreement, be widely used in the analysis of agreement, test In the systems such as card, realization, test.

Procotol formal description language is generally divided into common part and expansion.Common part defines network association Relation between the ingredient and agreement of view, expansion is used to define some special details of procotol.In reality In the descriptive system on border, the common part that system is used all is identical, and for expansion, each system has uniqueness Part, because each system is to be described it is important that different.

Extending mark language（XML）It is a kind of wide variety of description language, stems from standard guiding identifiable language SGML. XML is a kind of meta-mark-up language, can define different markup languages according to different demands, and its grammer mainly includes element, place Reason instruction, annotation, attribute etc..The characteristics of XML, is mainly reflected at following 4 points：（1）The description of information is to separate with information processing 's；（2）XML document has self portrait ability；（3）XML has very strong open and autgmentability；（4）XML document has can It is confirmatory.

The existing research for Android system, the research in terms of protocol formal description is less, and is partial to Theoretic.Network traffics are generally had certain restriction by existing system or instrument, while the system to being installed has Large effect, therefore limit application.

The content of the invention

It is an object of the invention to provide the procotol formalized description instrument under a kind of Android system environment, solves The problems referred to above that prior art is present, the major function of the present invention is that capture flows through the packet of current system, and by packet Interior data are parsed, and are generated and output protocol formalized description.The function of system is broadly divided into three big modules：Network data Acquisition module, protocol formal describe parsing module and packet Context resolution module.

The above-mentioned purpose of the present invention is achieved through the following technical solutions：

Procotol formalized description instrument under Android system environment, including

（1）Based on the network data acquisition module of ARIXTRA, part of data acquisition is realized using the Tcpdump instruments increased income, Step includes the installation of Tcpdump and authorization method under ARIXTRA environment, and obtains the storage after data and management method three；

（2）Protocol formal describes parsing module, a kind of flow process of protocol language comprising four steps parsing and two The definition of Key Functions：

（2.1）Program current path is obtained；

（2.2）Construction ProtocolBuilder objects；

（2.3）Call recursionPROTree functions；

（2.4）Obtain dom tree；

（2.5）Two Key Functions definition：RecursionPROTree () function, and addToBuilderList () letter Number；

（3）Packet content parsing module, including a kind of resolve packet flow process of five steps：

（3.1）Netpdl is parsed；

（3.2）Obtain dom tree root node；

（3.3）Search the entrance of a protocol definition；

（3.4）Agreement is created in protocol container；

（3.5）Construction protocol elements.

Described packet content parsing module, including the definition of four parsing element classes：

（4.1）To the PRO_Item () being briefly described to node；

（4.2）To determine the whether visible PRO_ItemViewable () of node；

（4.3）To the PRO_AbstractElement () being described abstractly to node；

（4.4）And as the PRO-Element () of base class, wherein comprising the data element in protocol architecture and control unit Element.

Described packet content parsing module includes the Key Functions of four parsings：

（5.1）For constructing the getProInfo () of protocol node object；

（5.2）The getNextNodeForData of the son field of significant present field under for obtaining current data ()；

（5.3）For constructing the createProtocol () of protocol architecture；

（5.4）And for arranging protocol architecture in filiation between element setAssoc ().

Tools chain disclosed by the invention and method are to provide a kind of protocol formal description run under ARIXTRA environment Realize flow process, stated by formalization, lifting future is further directed to the unified Analysis ability of different agreement, contributes to exploitation Network protocol analysis and content auditing instrument under new Android system, make up the deficiency of current this area research and application, There can be certain using value in scientific research and industrial circle.

The beneficial effects of the present invention is：Through on instrumental function, capture packet loss, the survey on systematic function impact etc. Examination, compared with prior art, the main advantage of the present invention is network packet can be carried out in the case of normal discharge Capture, impact of the programming to system is little, being capable of the normally smoothly work of complete paired data packet protocol formalized description.

Description of the drawings

Accompanying drawing described herein is used for providing a further understanding of the present invention, constitutes the part of the application, this Bright illustrative example and its illustrate, for explaining the present invention, not constituting inappropriate limitation of the present invention.

Fig. 1 is the Android system architectural schematic of the present invention；

Fig. 2 is that the protocol formal of the present invention describes process of analysis schematic diagram；

Fig. 3 is recursionPROTree () the function schematic flow sheet of the present invention；

Fig. 4 is addToBuilderList () the function schematic flow sheet of the present invention；

Fig. 5 is the packet content process of analysis schematic diagram of the present invention；

Fig. 6 is the storage schematic diagram of the capture packet of the present invention；

Fig. 7 is the Transmission Control Protocol structure elucidation schematic diagram of the present invention；

Fig. 8 is the packet content analysis result schematic diagram of the present invention.

Specific embodiment

The detailed content and its specific embodiment of the present invention are further illustrated below in conjunction with the accompanying drawings.

Referring to known to Fig. 1 to Fig. 8, the procotol formalized description instrument under the Android system environment of the present invention, including

（1）Based on the network data acquisition module of ARIXTRA, realized using the Tcpdump instruments increased income, step includes ARIXTRA The installation of Tcpdump and authorization method under environment, and obtain the storage after data and management method three；

（2）Protocol formal describes parsing module, a kind of flow process of protocol language comprising four steps parsing and two The definition of Key Functions, four steps include that program current path obtains, constructs ProtocolBuilder objects, calls RecursionPROTree functions, obtain DOM；Two Key Functions definition include recursionPROTree () function, and AddToBuilderList () function；

（3）Packet content parsing module, including a kind of resolve packet flow process of five steps, Netpdl parsings, obtain Dom tree root node, searches the entrance of a protocol definition, and agreement is created in protocol container, constructs protocol elements.

Described packet content parsing module, including the definition of four parsing element classes：For constructing protocol node pair The getProInfo () of elephant, for obtaining current data under significant present field son field GetNextNodeForData (), for constructing the createProtocol () of protocol architecture, and for arranging protocol architecture The setAssoc () of the filiation between middle element；

Described packet content parsing module, including the Key Functions of four parsings：Simply to be retouched to node The PRO_Item () for stating, to determine the whether visible PRO_ItemViewable () of node, to carry out abstract retouching to node The PRO_AbstractElement () for stating, and as the PRO-Element () of base class, wherein comprising the number in protocol architecture According to element and control element.

Embodiment：

1st, the network data acquisition based on ARIXTRA

The filtration and capture of network packet are substantially carried out based on the network data acquisition module of ARIXTRA.Using Tcpdump Instrument realizes the collection of packet and management function.Process is as follows：

（1）Tcpdump is uploaded in mobile phone/system/bin/ files, and authority is given by Tcpdump, that is, run Order adb shell 6755/system/bin/Tcpdump of chmod

（2）Operation Tcpdump, on condition that operating system has obtained root authority, otherwise Tcpdump cannot capture data Bag.The following is the order of capture packet.

adb shell Tcpdump -i any -p -s 0 -w /sdcard/capture.pcap

# "-i any": listen on any network interface

# "-p": disable promiscuous mode (doesn't work anyway)

# "-s 0": capture the entire packet

# "-w": write packets to a file (rather than printing to stdout)

（3）After packet capture, storage format is .cap, as shown in Figure 6.

, protocol formal description parsing

Formal description language into a tree structure, this is set various protocols structure organization using DOM parser Shape structure is parsed, and extracts node and its attribute in structure, and the node in tree and corresponding attribute and node Between filiation be packaged, eventually form the dom tree for storing protocol architecture and agreement relevant information.

The present invention is analyzed using dom tree to the node of formalized description, and it can be with one kind independently of platform and language The mode of speech accesses and changes the content and structure of a document, there is packaged ProtocolBuilder in java language Class is come the associative operation that defines and perform DOM.ProtocolBuilder extracts the name of each node using the API that DOM is provided With attribute construction proArrayList objects, protocol tree is formed.

Document objects are set up, the getChildNodes () method provided using Document objects obtains all associations The root node of view, by recursionPROTree methods are called afterwards dom tree is generated.Protocol formal describes process of analysis such as Shown in accompanying drawing 2：

Key Functions design is as follows.

（1）RecursionPROTree () function.Effect is to obtain a node, under being mounted to father node, recursive generation The child node of the node.Nodes parameters are all child nodes included in father node, and level parameters are record current recursions Depth, is thus worth the relation determined between node.The flow chart of function is as shown in Figure 3.

（2）AddToBuilderList () function.Effect is that the node by obtaining obtains nodal information, and node is changed For node object, nodal information is converted to the attribute of node object, node object is returned into program, flow chart such as accompanying drawing 4.

TCP layer agreement in the packet structure that captured is described, TCP layer association can be obtained from description result Discuss interior each field corresponding actual value in the packet, and the option that current TCP protocol is subsidiary.Transmission Control Protocol parsing is such as attached Shown in Fig. 7.The explanation of field of parsing is as follows：

First<field>In field, acquisition be confirmation in Transmission Control Protocol to packet information, length is four Byte.

Second<field>In field, acquisition is TCP packet header length, because the header packet information of TCP is not fixed, can root Dynamically change according to Option fields, so the real data of the field can be utilized to be analyzed Option data backward.

Last<field>Field is the option field in TCP, by the TCP packet header file size for determining before The length that dynamic is generated, the main additional information carried required for Transmission Control Protocol.Protocol length is determined by TCP packet header length.

, packet content parsing

It is to show data therein according to the form of prior regulation to packet Context resolution.Protocol architecture is parsed It is that another kind of data structure is formed from dom tree, can be a resolve packet out, and for a spy by this structure The parsing of fixed packet is referred to as protocol analysis.

For the packet of a reality, its protocol format is fixed, and each field has corresponding value.In parsing As a result in subtree, tree is identical with protocol architecture, the description field to be shown simply is added in each node and is being counted According to the position in bag.After to resolve packet, a minor structure of protocol architecture, the i.e. several associations of certain in protocol architecture can be generated The combination of view structure, it is the real composition of this packet.By classes such as data element, control element, expression formula, agreements, Protocol architecture can be just generated according still further to certain algorithm.The process of packet content parsing is as shown in Figure 5.

The algorithm of protocol architecture parsing is as follows：

Step1：The root node of dom tree is obtained from protocol architecture analysis result；

Step2：The traversal interface lookup namespace node provided using DOM tree node is the node of " protocol ", that is, look into Look for a protocol definition entrance；

Step3：The agreement is created, and the agreement is put in protocol container；

Step4：From<protocol>Node begins stepping through its child node, and according to the different type of node corresponding unit is created Element, until<protocol>All child nodes it is all traversed；

Step5：Search whether that also namespace node is<protocol>Node, that is, search whether also protocol definition, If then repeating the 3rd, 4 steps；Exit if not, complete protocol architecture parsing.

Packet content parsing key element class is defined as follows：

（1）PRO_Item()

CXMLItem is that node is briefly described, and the data of its storage are correspondence attribute names in nodal community list For the property value of " name ".

（2）PRO_ItemViewable()

During for agreement Packet analyzing, not all node is all visible, and only be only can for back end See, so PRO_ItemViewable is the special node of a class, they determine whether node is visible.

（3）PRO_AbstractElement()

PRO_AbstractElement is the abstractdesription to node.It provide node between filiation and The corresponding agreement of the element, and there is provided important function showSummary () and getNextNode ().

（4）PRO_Element()

PRO_Element is the base class of PRO_Item, PRO_ItemViewable, and PRO_AbstractElement.Association Data element and control element in view structure is inherited from PRO_Element.

The Key Functions definition of packet content parsing：

（1）getProInfo()

For protocol node object formation, function is with existing data the structure of field to be compared and calculated.It is right In displayable data field, data are obtained according to the length of field and is stored the data in the corresponding object of the field, and And the pointer for pointing to current parsing position is moved backward to appropriate position；For not displayable control field, to the word The structure of section carries out following calculating：

For IF structures, the result of calculation expression is needed；For Switch structures, the function needs which height calculated Case structures are eligible；For Loop structures, the function needs the termination condition for calculating circulation.

（2）getNextNodeForData()

During parsing, acquirement has the son field of the present field of a meaning under current data.For data Field, it is control field that when son field is all non-existent therefore main parameter：For IF words Section, if conditional expression is true, then return minor structure；For Switch fields, qualified sub- Case structures are returned； For Loop fields, minor structure is returned, until till meeting circulation exit criteria.

（3）createProtocol()

Use during construction protocol architecture, for each agreement passes through the construction of function protocol architecture.

（4）setAssoc()

Filiation in for arranging protocol architecture between element.

Accompanying drawing 8 shows the Context resolution result of the ethernet and ip agreements in packet.

The preferred embodiment of the present invention is the foregoing is only, the present invention is not limited to, for the technology of this area For personnel, the present invention can have various modifications and variations.All any modification, equivalent substitution and improvements made for the present invention etc., Should be included within the scope of the present invention.

Claims (3)

1. the procotol formalized description instrument under a kind of Android system environment, it is characterised in that：Including

（1）Based on the network data acquisition module of ARIXTRA, part of data acquisition is realized using the Tcpdump instruments increased income, step Installation and authorization method including Tcpdump under ARIXTRA environment, and obtain the storage after data and management method three；

（2）Protocol formal describes parsing module, the flow process and two keys of a kind of parsing of the protocol language comprising four steps The definition of function：

（2.1）Program current path is obtained；

（2.2）Construction ProtocolBuilder objects；

（2.3）Call recursionPROTree functions；

（2.4）Obtain dom tree；

（2.5）Two Key Functions definition：RecursionPROTree () function and addToBuilderList () function；

The effect of recursionPROTree () function is to obtain a node, under being mounted to father node, the son of recursive generation node Node；Nodes parameters are all child nodes included in father node, and level parameters are the depth for recording current recursion, are thus worth Determine the relation between node；

The effect of addToBuilderList () function is that the node by obtaining obtains nodal information, and node is converted to into node pair As nodal information is converted to the attribute of node object, and node object is returned into program；

（3）Packet content parsing module, including a kind of resolve packet flow process of five steps：

（3.1）Netpdl is parsed；

（3.2）Obtain dom tree root node；

（3.3）Search the entrance of a protocol definition；

（3.4）Agreement is created in protocol container；

（3.5）Construction protocol elements.

2. the procotol formalized description instrument under Android system environment according to claim 1, it is characterised in that：Institute The packet content parsing module stated, including the definition of four parsing element classes：

（4.1）To the PRO_Item () being briefly described to node；

（4.2）To determine the whether visible PRO_ItemViewable () of node；

（4.3）To the PRO_AbstractElement () being described abstractly to node；

（4.4）And as the PRO_Element () of base class, wherein comprising data element and control element in protocol architecture.

3. the procotol formalized description instrument under Android system environment according to claim 1 and 2, its feature exists In：Described packet content parsing module includes the Key Functions of four parsings：

（5.1）For constructing the getProInfo () of protocol node object；

（5.2）The getNextNodeForData () of the son field of significant present field under for obtaining current data；

（5.3）For constructing the createProtocol () of protocol architecture；

（5.4）And for arranging protocol architecture in filiation between element setAssoc ().