For a thorough understanding of procedures in various network applications, and to automatically classify, recognize, trace, and control them, it is necessary that the state machine representing application sessions is obtained in advance. This article presents a novel approach to reversely infer a protocol state machine from collected data of the application layer. Protocol state machines are derived using a method of error-correcting grammatical inference, which is based on symbol sequences that appear in the application sessions. The techniques are implemented into a tool called PREUGI, which is conducted in a real network, containing a number of real applications with several application layer protocols, to validate the proposed method.
OehlertP., Violating assumptions with fuzzing, IEEE Security and Privacy3(2) (2005), 58–62.
2.
RoeschM., Snort: Lightweight intrusion detection for networks, In Proc 13th Systems Administration Conference (LISA), 1999, pp. 229–238.
3.
VernP., Bro: A System for Detecting Network Intruders in Real-Time Computer Networks, 1999, pp. 229–238.
4.
DaveA., MSRPC Fuzzing with SPIKE. Technology Report, Immunity Inc, 2006.
5.
AarajN., RaghunathanA. and JhaN.K., Dynamic binary instrumentation-based framework for malware defense, In: Proc of the 5th Int’l Conf on Detection of Intrusions and Malware, and Vulnerability Assessment, Springer-Verlag, 2008, pp. 64–87.
6.
CuiW., PaxsonV., WeaverN. and KatzR., Protocol-Independent Adaptive Replay of Application Dialog, In 13th Symposium on Network and Distributed System Security, 2006.
7.
CuiW., KannanJ. and WangH., Discoverer, Automatic Protocol Reverse Engineering from Network Traces, In 16th Usenix Security Symposium, 2007.
8.
HouC.Y. and ZhuL.J., Unknown protocol reversing engineering for CCSDS protocol, Journal of Computer Applications34(1) (2014), 23–26, 53.
9.
MaJ., LevchenkoK., KreibichC., SavageS. and VoelkerG.M., Unexpected means of protocol inference. In: Proc of the 6th ACM SIGCOMM Conf on Internet Measurement, ACM, 2015, pp. 313–326.
10.
CaballeroJ. and SongD., Polyglot: Automatic Extraction of Protocol Format using Dynamic Binary Analysis. In ACM Conference on Computer and Communications Security (CCS), 2007, pp. 317–329.
11.
LinZ., JiangX., XuD. and ZhangX., Automatic Protocol Format Reverse Engineering through Context-Aware Monitored Execution, In 15th Symposium on Network and Distributed System Security (NDSS), 2008.
12.
WondracekG., KruegelC. and KirdaC., Automatic Network Protocol Analysis, Proceedings of the 15th Annual Network and Distributed System Security Symposium (NDSS), 2008, pp. 1–18.
13.
CaballeroJ. and SongD., Automatic protocol reverse-engineering: Message format extraction and field semantics inference, Computer Networks57(2) (2013), 451–474.
14.
ShevertalovM. and MancoridisS., A reverse engineering tool for extracting protocols of networked applications, In Proc of the Working Conf on Reverse Engineering, 2007.
15.
ComparettiP.M., WondracekG., KruegelC. and KirdaE., Prospex, Protocol Specification Extraction, IEEE Symposium on Security and Privacy, 2009.
16.
RifilòA., BurschkaS. and BiersackE., Traffic to protocol reverse engineering, In Proc of the Int Conf on Computational Intelligence for Security and Defense Applications, 2009.
17.
JoãoA., NunoN. and PauloV., ReverX: Reverse Engineering of Protocols, Technical Reports, 2011.
18.
CaballeroaJ. and SongD., Automatic protocol reverse-engineering: Message format extraction and field semantics inference, Computer Networks57(2) (2013), 451–474.
19.
LuoJ.Z. and YuS.Z., Position-based automatic reverse engineering of network protocols, Journal of Network and Computer Application50(1) (2013), 431–439.
20.
Mark DeYoungE., , Dynamic Protocol Reverse Engineering: A Grammatical Inference Approach Master’s thesis, Air Force Inst of Tech, Wright-Patterson AFB, OH Graduate School of Engineering and Management, 2008.
21.
MIT Linkon Laboratory, DARPA Intrusion Detection Evaluation Data Set, 1998.
22.
LoD. and KhooS., QUARK: Empirical Assessment of Automaton-based Specification Miners, In 13th Working Conference on Reverse Engineering (WCRE), 2006.
23.
SaltonG., Automatic Information Organization and Retrieval, 1968.
24.
NimmerJ.W. and ErnstM.D., Automatic generation of program specifications, In Proc of the 2002 International Symposium on Software Testing and Analysis, 2002.
