AwesomeREA.org

2014 · Conference paper

Towards Automated Protocol Reverse Engineering Using Semantic Information

Georges Bossert; Frédéric Guihéry; Guillaume Hiet

Infers the vocabulary of an undocumented protocol, its message types and formats, from communication traces. The approach uses contextual information embedded in the messages to improve message clustering and the identification of field boundaries; the HAL record lists contextual clustering and semantic sequence alignment as keywords. The authors motivate the work with parsers and traffic generators for network security products, and compare it with their own reimplementations of ASAP, Discoverer and ScriptGen. The first two authors are the authors of Netzob, the open-source protocol reverse-engineering framework.

Scope and limitations

The method starts from captured traces and addresses the protocol’s vocabulary, not its grammar or state machine; contextual hints help only where such information appears in the observed messages. Baseline results come from the authors’ reimplementations of ASAP, Discoverer and ScriptGen rather than the original tools. The comparative study and its results are the authors’ 2014 evaluation and are not summarized here. Netzob has changed substantially since 2014: the curated Netzob record describes the later 2.x Python library, and this record does not attribute the paper’s results to that release.

Why it fits this collection

Documents the trace-based inference approach from the authors of Netzob, already curated as a protocol-analysis tool, and complements the collection’s other traffic-based and executable-assisted format inference research.

Publication and review details

Venue
ACM ASIA CCS 2014
Status
Conference paper
Publication / posting date
June 4, 2014
Date source
ACM’s Crossref deposit records print and online publication on 2014-06-04. The HAL record gives the same date as the first day of the June 4–6 conference; the conference dates alone are not used as the basis.
DOI
10.1145/2590296.2590346

Crossref, the archived ACM page and the HAL record agree on the three authors, the ASIA CCS ’14 proceedings and pages 51–62; the ACM metadata uses sentence case, and the record follows the capitalization in the HAL record. Crossref lists this paper under DOI 10.1145/2590296.2590346; the neighboring 10.1145/2590296.2590338 is a different paper. The HAL record has no attached file. This review used the ACM abstract, Crossref and HAL metadata and the Netzob repository; evaluation details beyond the abstract are not recorded. The code link is the authors’ Netzob repository, whose AUTHORS.txt names Georges Bossert and Frédéric Guihéry; its reviewed 2023 head ships the GPL-3.0 license text and is not identified as the 2014 implementation. No code or experiments were run.

Sources reviewed

Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.

Report an outdated entry Suggest a translation fix

Related entries

Matched by the same code repository or publication identifier.

Primary sources

  1. https://dl.acm.org/doi/10.1145/2590296.2590346
  2. https://web.archive.org/web/20240405105101/https://dl.acm.org/doi/10.1145/2590296.2590346
  3. https://api.crossref.org/works/10.1145/2590296.2590346
  4. https://centralesupelec.hal.science/hal-01009283v1
  5. README.rst GitHub · netzob/netzob · Revision 088fe76
  6. AUTHORS.txt GitHub · netzob/netzob · Revision 088fe76
  7. COPYING.txt GitHub · netzob/netzob · Revision 088fe76