AwesomeREA.org

Tool

PULSAR

Research prototype by Hugo Gascon and colleagues that learns a model of an unknown network protocol from recorded traffic. Messages extracted from PCAP traces are embedded as token or n-gram vectors, clustered by matrix factorization through the PRISMA R module, and turned into a Markov-chain state model with message templates and rules linking fields to earlier messages, written out as model files and a Graphviz state graph. The same models drive the tool's session simulator and stateful fuzzer, described in the authors' SecureComm 2015 paper; this entry covers only the protocol-learning part.

Targets
Protocol
Category
Protocol analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Reviewed at master commit 3c61178 (2022-06-07), the last push; the repository has no releases or tags, and the CLI reports itself as v0.1-dev. Contributed changes merged in 2021 converted the code from Python 2 to Python 3 with 2to3. There are no tests or CI configuration.
  • Learning takes PCAP traces of the protocol under study, or the captures that Cuckoo sandbox stored for analyzed samples. The repository commits one example model, models/itunes-xbmc, with the roughly 3 MB iTunes–XBMC capture it was learned from (itunes-xbmc.pcap, part of the 2015 initial commit) and its intermediate Derrick, Sally and Harry files; it bundles no other target data.
  • INSTALL.md has users clone the PRISMA R module into pulsar/modules, build Konrad Rieck's Derrick and Sally C tools from their repositories, install R, Wireshark's mergecap and Graphviz, and pip-install pygraphviz, progressBar, NumPy and python-Levenshtein, giving package commands for CentOS only. Dependencies are unpinned; PRISMA was last updated in 2018, and Derrick and Sally in 2019.
  • The README points to the SecureComm 2015 paper for the method and to an AISec 2012 paper on learning stateful models for network honeypots; results reported there are the authors' and were not reproduced. Learned templates and state machines are statistical approximations that need analyst validation.
  • BSD-3-Clause (Copyright 2014 Hugo Gascon); the bundled pulsar/core/sippy SIP stack keeps its own GPL-2.0-or-later notices. This review ran nothing, and the record does not describe the fuzzing workflow.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · hgascon/pulsar · Revision 3c61178
  2. INSTALL.md GitHub · hgascon/pulsar · Revision 3c61178
  3. LICENSE GitHub · hgascon/pulsar · Revision 3c61178
  4. pulsar.py GitHub · hgascon/pulsar · Revision 3c61178
  5. pulsar/core/model.py GitHub · hgascon/pulsar · Revision 3c61178
  6. pulsar/core/cluster_generator.R GitHub · hgascon/pulsar · Revision 3c61178
  7. pulsar/conf/model.conf GitHub · hgascon/pulsar · Revision 3c61178
  8. models/itunes-xbmc GitHub · hgascon/pulsar · Revision 3c61178
  9. pulsar/core/sippy/SipCSeq.py GitHub · hgascon/pulsar · Revision 3c61178
  10. https://hugogascon.com/publications/2015-securecomm.pdf
  11. https://doi.org/10.1007/978-3-319-28865-9_18
  12. README.md GitHub · tammok/PRISMA · Revision a48624f

More in Protocols

All 66 entries in Protocols