2007 · Conference paper
Polyglot: Automatic Extraction of Protocol Message Format using Dynamic Binary Analysis
Polyglot infers the format of a message that a program receives by monitoring how the program binary processes it, an approach the authors call shadowing. An execution monitor taints network input and records an instruction trace; offline analyses then find direction fields, such as length and pointer fields, from tainted memory accesses and loop conditions, separators from comparisons between tainted bytes and constants, multi-byte fixed-length fields from how instructions group input bytes, and protocol keywords from successful comparisons. It works on stripped IA-32 binaries without source code or debugging information.
Scope and limitations
It extracts the format of one received message at a time and only of messages given to the analysis; messages that never appear stay unknown, and messages the program sends are not analyzed. It does not infer the protocol state machine. The evaluation covers eleven 2007-era programs implementing DNS, HTTP, IRC, ICQ and Samba, mostly Windows servers plus an ICQ client and a Linux Samba server, with one representative message per protocol, compared against Wireshark 0.99.5 dissectors. Field formats omit data types and encodings, analysis is at byte granularity so sub-byte flags are missed, and field semantics are limited to direction fields; timestamps, checksums and addresses are not identified. Message boundaries rely on assuming a synchronous protocol, unused fixed-length fields after an ICQ length field were merged into the variable-length field, and the authors state that the techniques are not fully resistant against obfuscation.
Why it fits this collection
Adds binary-analysis inference of protocol message formats from a running implementation, the line of work that the collection's BinPRE record continues, complementing its trace-based protocol research.
Publication and review details
- Venue
- ACM CCS 2007
- Status
- Conference paper
- Publication / posting date
- October 28, 2007
- Date source
- ACM’s Crossref deposit records both print and online publication on 2007-10-28. This entry uses that date, not the October 29–November 2 conference dates printed on the paper.
- DOI
- 10.1145/1315245.1315286
Crossref records the title as “Polyglot” with the lowercase subtitle “automatic extraction of protocol message format using dynamic binary analysis”, the four-author order and pages 317–329; this entry follows the capitalization printed on the paper. dl.acm.org refused automated requests during this review, so the text was checked in the 13-page ACM-formatted copy hosted on Dawn Song’s Berkeley site, which carries the CCS’07 copyright notice and page numbers from 317. A 15-page author version with appendices is hosted at UC Riverside and says the definitive version was published at CCS’07. The execution monitor is cited as the authors’ earlier work and is not released with the paper. The paper gives no code or project link, so both stay null, and nothing was run.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.