Abstract:Protocol reverse engineering, the process of (re)constructing the protocol context of communication sessions by an implementation, which involves translating a sequence of packets into protocol messages, grouping them into sessions, and modeling state transitions in the protocol state machine, is well-known to be invaluable for many network security applications, including intrusion prevention and detection, traffic normalization, and penetration testing, etc. However, current practice in deriving protocol specifications is either mostly manual or focusing on automatic reverse engineering the message format only and leaving the protocol state machine inverse undone. Although regular expressions offer superior expressive ability and flexibility, application protocols are described by regular expression manually based on sufficiently understanding protocol itself. At present there is not an effect method to realize classification, recognition and control automatically for the known applications and the unknown applications in future. In this paper a novel approach is presented to model network application specification. In this work, the whole automatic protocol reverse engineering is realized through accomplishing the protocol state machine, and then the FSMs are translated to corresponding regular expressions to enrich and update the pattern database. This approach uses grammatical inference and is motivated by the observation that an implementation of the protocol is inherently a state transition process, the state machine model the essence exactly. The important significance is to describe various state protocols with a common method through modeling the protocol state transition, including known and unknown ones. This approach had been implemented in the system and evaluated using real-world implementations of three different protocols: HTTP, SMTP, FTP, and compared the extracted protocol to the corresponding other newly system, such as l7-filter.

Recovering Models of Network Protocol Using Grammatical Inference

Learning Automata Representation Of Network Protocol By Grammar Induction

ABInfer: A Novel Field Boundaries Inference Approach for Protocol Reverse Engineering

Automatic Network Protocol Automaton Extraction

A Novel Modeling Method for Analysis of IP Networks

Protocol Specification Inference Based on Keywords Identification

Inference of Protocol State Machine Using a Semantic-Related Labeling Method Based on Dynamic Taint Analysis

Reverse extraction of protocol model from network applications

Translation of Modified Predicate Transition Nets Models of Cummunication Protocols into Simulation Programs

Inferring State Machine from the Protocol Implementation Via Large Langeuage Model.

Inferring State Machine from the Protocol Implementation via Large Language Model

Automatically derived stateful network functions including non-field attributes

Exploiting Intra-Packet Dependency for Fine-Grained Protocol Format Inference

Network Communication Protocol Reverse Engineering Based on Auto-Encoder

Grammatical Inference as a Satisfiability Modulo Theories Problem

A Markov Random Field Approach to Automated Protocol Signature Inference

Modeling and Testing of Network Protocols with Parallel State Machines.

Unknown Pattern Extraction for Statistical Network Protocol Identification

A Network Protocol Reverse Engineering Method Based On Dynamic Taint Propagation Similarity

Alembic: Automated Model Inference For Stateful Network Functions

A Semantics Aware Approach to Automated Reverse Engineering Unknown Protocols