A Reverse Engineering Tool for Extracting Protocols of Networked Applications

Shevertalov, M.; Mancoridis, Spiros

doi:10.1109/wcre.2007.6

Cited by 40 publications

(31 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Different from Polyglot and Dispatcher, Protocol Informatics [11] uses algorithms found in the bioinformatics field to extract the format of protocol messages collected from network traces. Shevertalov and Mancoridis proposed a tool based on network traces called PEXT [12] to analyze finite state machines using private protocols. In addition, PEXT uses the longest common subsequence (LCSS) [13] to classify private protocol messages into clusters.…”

Section: Related Workmentioning

confidence: 99%

“…Approaches based on network traces mentioned in [11,12,[14][15][16]18] focus on network communication protocols such as ICMP, FTP, DNS, or certain undocumented communication protocols running on botnets instead of UAV flight control protocols. As a result, the approaches described above cannot be used for reverse engineering of private flight control protocols for UAVs directly, and they cannot extract the meaning of flight control commands.…”

Section: Related Workmentioning

confidence: 99%

“…Then, in cases in which different types of commands have the same length, we group commands of the same cluster into subclusters according to a certain distance among commands. We use the LCSS [13] described in [12] to calculate the distance between two commands with the same length, and , and we use hierarchical clustering [21] to classify the cluster into subclusters based on the LCSS distance.…”

Section: Stx Len Seq Sys Comp Msg Payload Ck Field 1 Field 2 Field 3 mentioning

confidence: 99%

“…Whereas keywords reflect the format or structure of a group of commands, the field semantics of dynamic fields = + 1 − (7) end for (8) end for (9) for all do (10) for ← 0 to − do (11) temp = 0 (12) for ← 0 to − 1 do (13) add | + − Δ Γ | to temp (14) end for (15) add temp to …”

Section: Extract Format and Infer Field Semanticsmentioning

confidence: 99%

See 3 more Smart Citations

Automatic Reverse Engineering of Private Flight Control Protocols of UAVs

Jian

Tang

et al. 2017

Security and Communication Networks

View full text Add to dashboard Cite

The increasing use of civil unmanned aerial vehicles (UAVs) has the potential to threaten public safety and privacy. Therefore, airspace administrators urgently need an effective method to regulate UAVs. Understanding the meaning and format of UAV flight control commands by automatic protocol reverse-engineering techniques is highly beneficial to UAV regulation. To improve our understanding of the meaning and format of UAV flight control commands, this paper proposes a method to automatically analyze the private flight control protocols of UAVs. First, we classify flight control commands collected from a binary network trace into clusters; then, we analyze the meaning of flight control commands by the accumulated error of each cluster; next, we extract the binary format of commands and infer field semantics in these commands; and finally, we infer the location of the check field in command and the generator polynomial matrix. The proposed approach is validated via experiments on a widely used consumer UAV.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Stx Len Seq Sys Comp Msg Payload Ck Field 1 Field 2 Field 3 mentioning

confidence: 99%

Section: Extract Format and Infer Field Semanticsmentioning

confidence: 99%

See 2 more Smart Citations

Automatic Reverse Engineering of Private Flight Control Protocols of UAVs

Jian

Tang

et al. 2017

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…This is done by instrumenting the protocol application by studying how the program parses the messages. [13] focuses more on the state machine construction of multiple flows protocol. Application dialog replay is a very close domain since its goal is to construct a valid replay dialog by identifying the contents which need to be modified thanks to sequence alignment techniques [3] or by building a model from application inputs and outputs [14].…”

Section: Related Workmentioning

confidence: 99%

Automated Behavioral Fingerprinting

Jérôme

Abdelnur

State

et al. 2009

Lecture Notes in Computer Science

View full text Add to dashboard Cite

The original publication is available at www.springerlink.comInternational audienceThis paper addresses the fingerprinting of devices that speak a common, yet unknown to the fingerprinting engine, protocol. We consider a behavioral approach, where the fingerprinting of an unknown protocol is based on detecting and exploiting differences in the observed behavior from two or more devices. Our approach assumes zero knowledge about the syntax and state machine underlying the protocol. The main contribution of this paper consists in a two phased method. The first phase identifies the different message types using an unsupervised support vector clustering algorithm. The second phase is leveraging recent advances in tree support kernel in order to learn and differentiate different implementations of that protocol. The key idea is to represent behavior in terms of trees and learn the distinctive subtrees that are specific to one particular device. Our solution is passive and does not assume active and stimulus triggered behavior templates. We instantiate our solution to the particular case of a VoIP specific protocol (SIP) and validate it using extensive data sets collected on a large size VoIP testbed

show abstract

Reengineering

2014

Software Evolution and Maintenance

View full text Add to dashboard Cite

A Reverse Engineering Tool for Extracting Protocols of Networked Applications

Cited by 40 publications

References 13 publications

Automatic Reverse Engineering of Private Flight Control Protocols of UAVs

Automatic Reverse Engineering of Private Flight Control Protocols of UAVs

Automated Behavioral Fingerprinting

Reengineering

Contact Info

Product

Resources

About