Abstract:Protocol reverse engineering (PRE) aims to infer the specification of network protocols when the source code is not available. Specifically, field inference is one crucial step in PRE to infer the field formats and semantics. To perform field inference, binary analysis based PRE techniques are one major approach category. However, such techniques face two key challenges - (1) the format inference is fragile when the logics of processing input messages may vary among different protocol implementations, and (2) the semantic inference is limited by inadequate and inaccurate inference rules. To tackle these challenges, we present BinPRE, a binary analysis based PRE tool. BinPRE incorporates (1) an instruction-based semantic similarity analysis strategy for format extraction; (2) a novel library composed of atomic semantic detectors for improving semantic inference adequacy; and (3) a cluster-and-refine paradigm to further improve semantic inference accuracy. We have evaluated BinPRE against five existing PRE tools, including Polyglot, AutoFormat, Tupni, BinaryInferno and DynPRE. The evaluation results on eight widely-used protocols show that BinPRE outperforms the prior PRE tools in both format and semantic inference. BinPRE achieves the perfection of 0.73 on format extraction and the F1-score of 0.74 (0.81) on semantic inference of types (functions), respectively. The field inference results of BinPRE have helped improve the effectiveness of protocol fuzzing by achieving 5-29% higher branch coverage, compared to those of the best prior PRE tool. BinPRE has also helped discover one new zero-day vulnerability, which otherwise cannot be found.

ABInfer: A Novel Field Boundaries Inference Approach for Protocol Reverse Engineering

Automatic Protocol Reverse Engineering for Industrial Control Systems with Dynamic Taint Analysis

Towards Automatically Reverse Engineering Vehicle Diagnostic Protocols

BinPRE: Enhancing Field Inference in Binary Analysis Based Protocol Reverse Engineering

Reverse Engineering Industrial Protocols Driven by Control Fields

MDIplier: Protocol Format Recovery Via Hierarchical Inference

DynPRE: Protocol Reverse Engineering Via Dynamic Inference

Research of Improved Probabilistic Packet Marking Algorithms

Automatic State Machine Inference for Binary Protocol Reverse Engineering

Hiding and Trapping: A Deceptive Approach for Defending against Network Reconnaissance with Software-Defined Network

ProInfer: inference of binary protocol keywords based on probabilistic statistics

PREIUD: An Industrial Control Protocols Reverse Engineering Tool Based on Unsupervised Learning and Deep Neural Network Methods

Lifting Network Protocol Implementation to Precise Format Specification with Security Applications

Network Communication Protocol Reverse Engineering Based on Auto-Encoder

A Distributed IP Spoof Detection System in Intranet

Inferring State Machine from the Protocol Implementation Via Large Langeuage Model.

Sub-messages extraction for industrial control protocol reverse engineering

Protocol vulnerability detection based on network traffic analysis and binary reverse engineering

AIFORE: Smart Fuzzing Based on Automatic Input Format Reverse Engineering

Inferring State Machine from the Protocol Implementation via Large Language Model

Exploiting Intra-Packet Dependency for Fine-Grained Protocol Format Inference