多属性决策的嵌入式操作系统识别技术.docVIP

基于多属性决策的嵌入式操作系统识别技术 摘要:针对嵌入式固件逆向解析过程中操作系统类型识别困难的问题，提出了一种基于多属性决策的嵌入式操作系统识别技术。对固件映像中反映出的嵌入式操作系统的多种特征进行综合分析并构建了相关的识别模型，利用向量夹角余弦计算与标准系统之间的相似度,最后阐述了识别的基本思想和具体实现流程。实验结果表明，该方法在某些特征缺失的情况下仍能得到较准确的识别结果。 关键词:嵌入式；固件；逆向解析；操作系统；多属性决策；向量夹角余弦；相似度  embedded systems recognition based on multi.attribute decision making zhang ping*, jiang lie.hui, liu tie.ming, xie yao.bin institute of information engineering, information engineering university, zhengzhou henan 450002, china abstract: aiming at the problem that operating system type is difficult to recognize in embedded firmware reversing analysis, an recognition technology which is based on multi-attribute decision making （madm) was proposed. comprehensively analyzed the multiply features in the firmware, built a recognition model, calculated the similarity using the vector included angle cosine method. the basic idea of recognition and the concrete realization of the process were described. experimental results show that this method can get more accurate recognition results in some cases that some features are missed. concerning the problem that it is difficult to recognize operating system type in embedded firmware reversing analysis, a recognition technology based on multi.attribute decision making （madm) was proposed. the paper comprehensively analyzed the multiple features in the firmware, built a recognition model, and calculated the similarity using the vector included angle cosine method. the basic idea of recognition and the concrete realization of the process were described. the experimental results show that this method can get more accurate recognition results in the cases with some features missing. key words: embedded; firmware; reverse analysis; operating system; multi.attribute decision making (madm); vector included angle cosine; similarity  0 引言 嵌入式操作系统逆向解析是嵌入式固件逆向解析的重要内容和难点之一，通过操作系统的逆向解析，可以实现对固件功能的理解，有利于嵌入式设备的维护和升级［1］。操作系统的逆向解析必须建立在操作系统类型已知的基础上。然而，在实际工作中，分析人员面向的往往是未知的二进制固件映像，无法确定操作系统类型、版本等相关信息，这样对该操作系统的逆向解析也就