2009 · Conference paper
Prospex: Protocol Specification Extraction
Prospex infers message formats and a protocol state machine from execution traces of a Linux server handling client sessions. Dynamic taint analysis splits each session into messages and recovers their formats; messages are then clustered into types by input-format, execution and server-impact similarity, such as the system calls, outputs and file paths a message triggers. The observed type sequences form an augmented prefix tree acceptor, which prerequisite and end-state heuristics label before Exbar computes a minimal consistent automaton. The resulting specifications are translated for the Peach fuzzer to reach later protocol states. The evaluation covers the Agobot command-and-control protocol, SMTP on Sendmail, SMB on Samba and SIP on Asterisk.
Scope and limitations
Prospex traces one endpoint, the server, and its taint tool runs only on Linux, so only Linux server binaries were analyzed. It cannot handle encrypted traffic: TLS sessions made up the 6.5% of 31,903 Postfix sessions that the inferred SMTP specification could not parse. Training sets are small (for example 16 SMTP and 31 SMB sessions), and the inferred machines cover only behavior exercised during training; two SMB states are artifacts of limited training variety, and SMB recall against the reference automaton is 0.58. Reference state machines were built manually by the authors, and soundness was checked with 50,000 random walks per protocol; the sk-strings and beams baselines are state-machine learners, not full protocol reverse-engineering systems. The fuzzing case studies found previously known issues in an older Samba release and in Asterisk, not new vulnerabilities in the latest Samba or Windows XP SMB versions tested.
Why it fits this collection
Adds an execution-based method that extracts both message formats and protocol state machines from observed sessions, complementing the collection’s active state-machine learning and format-only protocol inference research.
Publication and review details
- Venue
- IEEE S&P 2009
- Status
- Conference paper
- Publication / posting date
- May 2009
- Date source
- IEEE’s Crossref deposit and an archived copy of the IEEE Xplore page give May 2009, represented at month precision. The symposium dates are not substituted for a publication day.
- DOI
- 10.1109/SP.2009.14
Crossref and the archived IEEE Xplore page agree on the four authors, the 2009 30th IEEE Symposium on Security and Privacy proceedings, pages 110–125 and May 2009; Xplore does not mark the paper open access. The PDF is the 16-page copy on Christopher Kruegel’s UCSB site, with the same title and author order; its file metadata shows a September 2008 creation date and a 2009 IEEE PDF eXpress certification, and IEEE Xplore holds the version of record. The paper reports that its Peach statefulness extensions were integrated into Peach release 2.2 but links no Prospex code, traces or reference state machines. No code or experiments were run.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.