Abstract:Protocol traffic analysis is a fundamental problem regarding a variety of networking and security applications, such as intrusion detection and prevention systems, network management systems, and protocol specification parsers. In this paper, we propose ProHacker, a nonparametric approach that extracts robust and accurate protocol keywords from the byte sequences generated by an application protocol, and effectively identifies the protocol trace from mixed Internet traffic. ProHacker is based on the key insight that the n-grams of protocol traces have highly predictable statistical nature that can be effectively captured by statistical language models and be leveraged for robust and accurate protocol identification. In ProHacker, we first extract protocol keywords using a nonparametric Bayesian statistical model, and then use the corresponding protocol keywords to classify protocol traces by a semi-supervised learning algorithm. We implement and evaluate ProHacker on real-world traces, and our experimental results show that ProHacker can accurately identify the protocol trace with an average precision of about 99.4% and an average recall of about 99.28%. We compare the results of ProHacker to one state-of-the-art approach, ProWord, and one our previous work, Securitas, using backbone traffic. We note that ProHacker provides significant improvements on precision and recall for online protocol identification.

A Self-Revised Method of Protocol Identification Using Mutation Test

Adaptive IP Mutation: A Proactive Approach for Defending against Worm Propagation

A Mutation-Based Fuzz Testing Approach For Network Protocol Vulnerability Detection

A Protocol Security Testing Method Using Mutation Analysis

Brute Force Vulnerability Testing Technology Based on Data Mutation

An Efficient Mutation-Based Fuzz Testing Approach for Detecting Flaws of Network Protocol

Rethinking robust and accurate application protocol identification.

Rethinking Robust and Accurate Application Protocol Identification: A Nonparametric Approach

Mutation Testing of Protocol Messages Based on Extended TTCN-3

Algorithm for discovering SNMP protocol vulnerability

Improvement on Intrusion Detection Technology Based on Protocol Analysis and Pattern Matching

A new method for analyzing and improving security protocols

Protocol vulnerability detection based on network traffic analysis and binary reverse engineering

Improvement on Rules Matching Algorithm of Snort Based on Dynamic Adjustment

Research of Intrusion Detection Technology Based on Protocol Analysis

Research on Mutation Algorithm in Artificial Immune System

An Automatic Fuzz Testing Method Designed For Detecting Vulnerabilities On All Protocol

A Network Protocol Reverse Engineering Method Based On Dynamic Taint Propagation Similarity

Intrusion Immune Recognition Method Based on Affinity Mutation Mechanism

A model guided security vulnerability discovery approach for network protocol implementation

Intelligent Matching for Intrusion Detection Rules Based on Protocol Analysis