AwesomeREA.org

Research

CNNPRE (IEEE Access 2023)

Research code and data for CNNPRE, a message-type identification method for protocol reverse engineering by Javad Garshasbi and Mehdi Teimouri, published in IEEE Access in 2023. A single Colab notebook turns each message's padded bit string into a resized grayscale image, extracts features with an ImageNet-pretrained ResNet50 as transfer learning, adds message direction and length-group encodings, reduces the features with UMAP and clusters messages with agglomerative clustering and HDBSCAN, scoring each clustering against labelled message types. Preprocessed message datasets for twelve protocols, from ARP and DNS to SMTP and GSM, accompany the notebook.

Targets
Protocol
Category
Protocol analysis tools
Relationship
Learning resource
Sources reviewed

Requirements & limits

  • Paper: Javad Garshasbi and Mehdi Teimouri, “CNNPRE: A CNN-Based Protocol Reverse Engineering Method,” IEEE Access, vol. 11, pp. 116255–116268, 2023, DOI 10.1109/ACCESS.2023.3325391; Crossref lists it under CC BY-NC-ND 4.0. The bibliography has no separate record for it yet. The repository was reviewed at its 2026-01-13 head, a README update; the notebook last changed on 2023-07-06, and there are no releases.
  • The only code is cnnpre.ipynb, written for Google Colab. It pip-installs umap-learn and hdbscan, apt-installs TeX Live and pandoc for a PDF export, and otherwise relies on Colab's preinstalled TensorFlow, scikit-learn, OpenCV, pandas and yellowbrick without pinned versions. It downloads ImageNet ResNet50 weights, reads one hard-coded CSV (GSM5000-hex.csv) with a message count that must be edited for other datasets, and its last cells mount Google Drive to convert the notebook. There is no package, command-line tool or test.
  • Inputs are message-level CSVs with direction, labelled message type and each message as hex and bit strings. Data/ holds preprocessed CSVs for ARP, DHCP, DNS, FTP, GSM, HTTP, ICMP, NBNS, NTP, POP, SMTP and Syslog, PCAP/ holds the GSM capture 44CON-gsm-uplink-downlink-sim-example.pcap, and the README names the public WRCCDC 2021 regional competition captures as the other source. No PCAP-to-CSV preprocessing script is included, so a new protocol needs its own conversion, and the notebook's evaluation metrics need ground-truth message types.
  • The notebook covers message-type clustering only, not field, semantic or state-machine inference. Its results labelled K-Means take the cluster count from a K-means elbow search but cluster with agglomerative clustering, and the saved outputs show one GSM run. Accuracy figures are the paper's and were not reproduced; no notebook cell was run for this record.
  • GitHub detects no license and the repository has no license file, so the code and preprocessed datasets state no reuse terms; the paper's license covers the article, not the repository, and the captures keep their sources' terms. The reviewed sources establish no REA connection.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · JG91/CNNPRE · Revision c7679ee
  2. cnnpre.ipynb GitHub · JG91/CNNPRE · Revision c7679ee
  3. Data GitHub · JG91/CNNPRE · Revision c7679ee
  4. PCAP GitHub · JG91/CNNPRE · Revision c7679ee
  5. https://doi.org/10.1109/ACCESS.2023.3325391

More in References and learning

All 61 entries in References and learning