2023 · Conference paper

BinaryInferno: A Semantic-Driven Approach to Field Inference for Binary Message Formats

Jared Chandler; Adam Wick; Kathleen Fisher

Infers partial binary-message formats from static message samples without instrumenting an executable. Specialized detectors recognize floats, timestamps, lengths, entropy boundaries and serialization patterns; a graph-based integration step reconciles their descriptions. Across samples from ten protocols, the authors report top-level field-boundary precision of 0.69, recall of 0.73 and false-positive rate of 0.04 for the 1,000-message setting without analyst priors.

Scope and limitations

Assumes error-free, uncompressed, unencrypted, byte-aligned data and infers common fields or payload regions beginning at consistent offsets. It leaves optional/union fields and unsupported serialization patterns unresolved; sample diversity matters. The 26 encapsulated-payload test sets were pre-grouped using ground-truth message types, not discovered automatically. Ground truth merges adjacent fields that are constant across the sample; empty inference results are excluded from reported averages where stated. BI+ additionally uses supplied endianness and capture-time ranges. These are field-boundary results, not complete semantic recovery, protocol-state inference or behavioral equivalence.

Why it fits this collection

Provides trace-only semantic field inference that complements executable-assisted analysis and protocol-state learning, with explicit assumptions and evaluated false-positive behavior.

Publication and review details

Venue: NDSS 2023
Status: Conference paper
Publication / posting date: 2023 (exact date not verified)
Date source: The official NDSS paper and publisher-deposited Crossref metadata establish publication year 2023. Crossref supplies no publication month or day; the conference dates and DOI registration date are not substituted.
DOI: 10.14722/ndss.2023.23131

Three-author order, title and DOI agree across the publisher, paper and Crossref. No arXiv identifier or proceedings page range was verified; the PDF has 18 pages. The paper’s project URL leads to the author’s Tufts page, which links the repository. The reviewed 2023-05-02 snapshot has GPL-3.0-or-later code headers and a GPLv3 LICENSE; third-party trace provenance and rights require separate checking. README prerequisites are Python 3, sklearn, scipy and parallel, without pinned dependency versions; the pattern-search launcher also uses timeout and hardcodes 30 parallel jobs. Input is one hexadecimal message per line; timestamp search accepts a supplied time range. The actual entry file is binaryinferno/blackboard.py, despite the README’s basic-command blackboard.by typo. A dataset directory is present, but its README remains a placeholder. Historical setup and dataset completeness were not reproduced; no captures, binaries or model payloads were downloaded and no upstream code or notebooks were run.

Sources reviewed 2026-10-17

Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.

Scope and limitations

Why it fits this collection

Publication and review details

Primary sources