2024 · Conference paper
DynPRE: Protocol Reverse Engineering via Dynamic Inference
DynPRE starts from captured client–server traces and then interacts with a live protocol server to infer message formats and types. It detects session-specific identifiers such as cookies and rewrites them on the fly so that replayed requests stay valid. It then sends byte-level probe requests whose responses serve as semantic feedback for field identification, aligns the responses, and applies a request–response mapping refinement that also recognizes message types. On 12 protocols with 10-, 100- and 1,000-message datasets, the authors report average field perfection of 0.50 and message-type V-measure of 0.94, against 0.15–0.31 perfection for Netzob, NetPlier, FieldHunter, BinaryInferno and NEMESYS.
Scope and limitations
The method needs captured traces plus a reachable server that it can query repeatedly; it does not work from passive captures alone. Probing changes server state: each probe opens a new session, but protocols with global state, such as IoT device power state, can still degrade feedback. On the 1,000-message datasets an analysis averaged 259 minutes, 50,344 connection attempts and about 3.98 million exchanged messages, so slow or rate-limiting servers reduce efficiency. Encryption and authentication were disabled in the open-source evaluation setups, and encrypted traffic in the IoT case studies was decrypted with device private keys. Checksummed protocols need an added checksum-reversal step, shown only on ICMP. Format ground truth comes from tshark dissectors, and message types from manual reading of protocol documents. The five-device IoT case studies test whether generated messages trigger device behaviors, not whether specifications are complete. State-machine inference reuses existing methods and is not evaluated as a contribution.
Why it fits this collection
Adds active, server-interactive protocol inference, complementing the trace-only, binary-assisted and source-based protocol reconstruction research in this section.
Publication and review details
- Venue
- NDSS 2024
- Status
- Conference paper
- Publication / posting date
- 2024 (exact date not verified)
- Date source
- Internet Society-deposited Crossref metadata supplies only publication year 2024; the publisher PDF separately identifies the 26 February–1 March 2024 symposium, which is not used to assert a publication month or day.
- DOI
- 10.14722/ndss.2024.24083
The NDSS paper page lists the seven authors with affiliations and links the PDF and slides; Crossref gives the same author order and only the year 2024. The PDF footer gives the 26 February–1 March 2024 symposium in San Diego, ISBN 1-891562-93-2 and the DOI. No arXiv version was found. The paper says DynPRE is available at github.com/DynPRE/DynPRE, but the reviewed 2025-08-27 snapshot contains only a README asking readers to contact the authors by email for the code and declares no license. code_url is therefore null, and no public implementation is claimed. The paper ran the baselines from public releases, using a public re-implementation for FieldHunter. Nothing was run for this review.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.
Primary sources
- https://www.ndss-symposium.org/ndss-paper/dynpre-protocol-reverse-engineering-via-dynamic-inference/
- https://www.ndss-symposium.org/wp-content/uploads/2024-83-paper.pdf
- https://api.crossref.org/works/10.14722/ndss.2024.24083
- https://doi.org/10.14722/ndss.2024.24083
- README.md GitHub · DynPRE/DynPRE · Revision 3a0fdce