2018 · Conference paper
NEMESYS: Network Message Syntax Reverse Engineering by Analysis of the Intrinsic Structure of Individual Messages
Infers approximate field boundaries within individual binary-protocol messages from changes in bit congruence, and introduces Format Match Score to compare inferred segmentation with known protocol dissectors.
Scope and limitations
Requires plaintext payloads. Evaluation covers DNS, DHCP and NTP with protocol-tuned parameters. Single-byte fields are not inferred; zero-filled fields, character sequences and pseudo-random values can cause errors. FMS needs known field boundaries for validation. The output is approximate segmentation, not field semantics, a state machine or complete application/device behavior.
Why it fits this collection
Provides a foundational method for reconstructing wire-message structure from observed traffic.
Publication and review details
- Venue
- 12th USENIX Workshop on Offensive Technologies (WOOT 18)
- Status
- Conference paper
- Publication / posting date
- August 2018
- Date source
- The official USENIX BibTeX entry identifies August 2018 for the WOOT 18 workshop publication.
The official USENIX citation verifies this workshop paper; no DOI or arXiv identifier was verified. The linked author repository now integrates NEMESYS with later NEMETYL and 2022 methods, so the reviewed current commit is not claimed to be the original 2018 artifact. Its README identifies it as experimental and its LICENSE declares MIT.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.
Primary sources
- https://www.usenix.org/conference/woot18/presentation/kleber
- https://www.usenix.org/system/files/conference/woot18/woot18-paper-kleber.pdf
- https://www.usenix.org/biblio/export/bibtex/220576
- https://github.com/vs-uulm/nemesys/blob/e98da1d9baa5727d8f085823369c733416b66a21/README.md
- https://github.com/vs-uulm/nemesys/blob/e98da1d9baa5727d8f085823369c733416b66a21/LICENSE