AwesomeREA.org

2024 · Conference paper

BinPRE: Enhancing Field Inference in Binary Analysis Based Protocol Reverse Engineering

Jiayi Jiang; Xiyuan Zhang; Chengcheng Wan; Haoyi Chen; Haiying Sun; Ting Su

Infers protocol-message field boundaries and semantics from instrumented server binaries and input messages. BinPRE groups bytes by the instruction operators that process them, applies detectors for field types and functions, then refines results across similar messages. On eight protocols with 50 messages each, the authors report average field perfection of 0.73 and type/function F1 scores of 0.74/0.81.

Scope and limitations

This is field inference, not recovery of a protocol state machine or complete endpoint behavior. It requires an accessible, instrumentable implementation and runtime message processing; passive captures alone are insufficient. Perfection counts exactly segmented fields against all true fields, not fully recovered protocols. The detector library covers five semantic types and six functions. Byte-level taint cannot accurately resolve bit flags, and unexercised behavior is not established. Ground truth uses Wireshark dissectors and specifications; three binary-analysis baselines were author reimplementations. Reported fuzzing improvements are a downstream evaluation, not proof of implementation equivalence.

Why it fits this collection

Adds recent executable-assisted protocol field and semantic inference, complementing the collection’s traffic-based syntax inference and protocol-state learning research.

Publication and review details

Venue
ACM CCS 2024
Status
Conference paper
Publication / posting date
December 2, 2024
Date source
The publisher’s Crossref deposit records published/print publication on 2024-12-02 and a separate publisher publication-history assertion on 2024-12-09. This record uses the published/print date; the October 14–18 CCS meeting dates and the September arXiv submission are separate.
First arXiv submission
September 3, 2024
arXiv
2409.01994
Reviewed arXiv version
v1
DOI
10.1145/3658644.3690299

The author’s publication page links the CCS-formatted paper, the 17-page arXiv v1 and the artifact. Six-author order, DOI and proceedings pages match Crossref. The reviewed artifact snapshot is dated 2024-10-25 and declares no project-level license. Its README specifies Ubuntu 20.04, Python 3.8 and Intel Pin 3.28; the workflow runs a server and client and requires protocol/thread selection. The reviewed tree supplies a Modbus example, not a complete eight-protocol benchmark package; additional servers, captures and evaluation ground truth need separate setup. The README’s Docker example uses a privileged container, and the Dockerfile fetches a named branch rather than the reviewed commit. Public availability does not grant rights to bundled binaries or dependencies. No binaries, captures, containers or installers were downloaded, and no upstream code or experiments were executed.

Sources reviewed

Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.

Primary sources

  1. https://dl.acm.org/doi/10.1145/3658644.3690299
  2. https://api.crossref.org/works/10.1145/3658644.3690299
  3. https://tingsu.github.io/files/ccs24-BinPRE.pdf
  4. https://tingsu.github.io/files/publication.html
  5. https://arxiv.org/abs/2409.01994
  6. https://arxiv.org/pdf/2409.01994v1
  7. https://github.com/ecnusse/BinPRE/blob/9a32bd22b6158d285a237dec10d11403eda8ac4c/README.md
  8. https://github.com/ecnusse/BinPRE/blob/9a32bd22b6158d285a237dec10d11403eda8ac4c/requirements.txt
  9. https://github.com/ecnusse/BinPRE/blob/9a32bd22b6158d285a237dec10d11403eda8ac4c/Dockerfile
  10. https://github.com/ecnusse/BinPRE/blob/9a32bd22b6158d285a237dec10d11403eda8ac4c/install_pin.sh
  11. https://github.com/ecnusse/BinPRE/blob/9a32bd22b6158d285a237dec10d11403eda8ac4c/Artifact_Evaluation/BinPRE_scripts/run_modbus_client.sh
  12. https://github.com/ecnusse/BinPRE/blob/9a32bd22b6158d285a237dec10d11403eda8ac4c/Artifact_Evaluation/BinPRE_scripts/run_modbus_server.sh
  13. https://github.com/ecnusse/BinPRE/blob/9a32bd22b6158d285a237dec10d11403eda8ac4c/Analyzer/config.py
  14. https://github.com/ecnusse/BinPRE/blob/9a32bd22b6158d285a237dec10d11403eda8ac4c/Analyzer/AAA_Evaluation/Syntax_Evaluator.py