Position-based automatic reverse engineering of network protocols

Luo, Jianzhen; Shu, Yu

doi:10.1016/j.jnca.2013.01.013

Cited by 66 publications

(42 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…(1) Input: observation , frequency threshold Γ (2) Output: closed frequent string set L (3) # Find out the frequent strings (4) Initialization: frequent candidate set 1 = Σ, = 1 (5) while ̸ = do (6) # Check frequency of strings in (7) for ∈ do (8) # Freq( ) is the frequency of in (9) if Freq( ) < Γ then (10) Delete from (11) end if (12) end for (13) # end if (20) end for (21) = + 1; (22) end while (23) # Find out the closed frequent strings (24) Initialization: = 1 (25) while +1 ̸ = do (26) for 1 ∈ do (27) for 2 ∈ +1 do (28) # delete the substrings (29) if 1 ⊂ 2 then (30) Delete 1 from (31) Break (32) end if (33) end for (34) end for (35) Update L = L ∪ (36) = + 1 (37) end while (38) Update L = L ∪ Algorithm 1: Closed frequent string algorithm.…”

Section: System Overviewmentioning

confidence: 99%

“…The first challenge in our research is to determine the length of protocol keywords. Previous works [7][8][9][10][11][12] which are based on longest common subsequence (LCS) criteria select longest frequent substrings to be protocol keywords. For example, if "G", "E", "T", "GE", "ET", and "GET" are frequent substrings, "GET" will be chosen as the protocol keyword, since it is the longest substring.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Analyzing Network Protocols of Application Layer Using Hidden Semi-Markov Model

Cai

Luo

Lei

2016

Mathematical Problems in Engineering

Self Cite

View full text Add to dashboard Cite

With the rapid development of Internet, especially the mobile Internet, the new applications or network attacks emerge in a high rate in recent years. More and more traffic becomes unknown due to the lack of protocol specifications about the newly emerging applications. Automatic protocol reverse engineering is a promising solution for understanding this unknown traffic and recovering its protocol specification. One challenge of protocol reverse engineering is to determine the length of protocol keywords and message fields. Existing algorithms are designed to select the longest substrings as protocol keywords, which is an empirical way to decide the length of protocol keywords. In this paper, we propose a novel approach to determine the optimal length of protocol keywords and recover message formats of Internet protocols by maximizing the likelihood probability of message segmentation and keyword selection. A hidden semi-Markov model is presented to model the protocol message format. An affinity propagation mechanism based clustering technique is introduced to determine the message type. The proposed method is applied to identify network traffic and compare the results with existing algorithm.

show abstract

Section: System Overviewmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Analyzing Network Protocols of Application Layer Using Hidden Semi-Markov Model

Cai

Luo

Lei

2016

Mathematical Problems in Engineering

Self Cite

View full text Add to dashboard Cite

show abstract

“…The parameters and procedures are the same as Section 7.1. The grouped messages are taken as input into AutoReEngine [4] to extract protocol keywords. The protocol keywords extracted by AutoReEngine are shown in Table 3.…”

Section: Message Grouping For Improving Protocol Reverse Engineeringmentioning

confidence: 99%

“…Network protocol reverse engineering [1][2][3][4] is a promising approach to address the problem of recovering detailed specifications of unpublished or undocumented network protocols from the network trace. The specifications of protocols play an important role in the network security and management oriented issues, such as intrusion detection, fuzzing test [5], recovering and understanding command-and-command (C&C) protocols [6], and building intelligent honeypot [7].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Capturing Uncertainty Information and Categorical Characteristics for Network Payload Grouping in Protocol Reverse Engineering

Luo

Shu

Cai

2015

Mathematical Problems in Engineering

Self Cite

View full text Add to dashboard Cite

As a promising tool to recover the specifications of unknown protocols, protocol reverse engineering has drawn more and more attention in research over the last decade. It is a critical task of protocol reverse engineering to extract the protocol keywords from network trace. Since the messages of different types have different sets of protocol keywords, it is an effective method to improve the accuracy of protocol keyword extraction by clustering the network payload of unknown traffic into clusters and analyzing each clusters to extract the protocol keywords. Although the classic algorithms such as K-means and EM can be used for network payload clustering, the quality of resultant traffic clusters was far from satisfactory when these algorithms are applied to cluster application layer traffic with categorical attributes. In this paper, we propose a novel method to improve the accuracy of protocol reverse engineering by applying a rough set-based technique for clustering the application layer traffic. This technique analyze multidimension uncertain information in multiple categorical attributes based on rough sets theory to cluster network payload, and apply the Minimum Description Length criteria to determine the optimal number of clusters. The experiments show that our method outperforms the existing algorithms and improves the results of protocol keyword extraction.

show abstract

Clustering method in protocol reverse engineering for industrial protocols

et al. 2020

View full text Add to dashboard Cite

Automation in all aspects of industrial activity is currently needed in today's industries. Networks, which are the most essential elements of automation, have been widely used in industrial sites to realize such needs. However, network security threats and malfunctions at industrial sites can cause considerable physical damage. Damage can be prevented, and threats can be detected through network traffic monitoring. However, industrial protocols use selfdeveloped protocols to ensure rapid and efficient data transfer, and most selfdeveloped protocols are private networking protocols. Efficient network traffic monitoring requires a detailed understanding of the structure of industrial protocols. Studies on existing protocol reverse engineering methods for commercial protocols have indicated that there are many limitations in applying these methods to industrial protocols. Therefore, in this paper, we propose a method of analyzing the structure of private protocols that can be employed as industrial protocols. This methodology consists of six modules: traffic collection, message extraction, message clustering by size, message clustering by similarity, field extraction, and session analysis. We collect traffic using the Schneider Modicon M580 and demonstrate the validity of the proposed methodology by comparing collected traffic with existing protocol reverse engineering methods.

show abstract

Position-based automatic reverse engineering of network protocols

Cited by 66 publications

References 10 publications

Analyzing Network Protocols of Application Layer Using Hidden Semi-Markov Model

Analyzing Network Protocols of Application Layer Using Hidden Semi-Markov Model

Capturing Uncertainty Information and Categorical Characteristics for Network Payload Grouping in Protocol Reverse Engineering

Clustering method in protocol reverse engineering for industrial protocols

Contact Info

Product

Resources

About