A Survey of Automatic Protocol Reverse Engineering Approaches, Methods, and Tools on the Inputs and Outputs View

Abstract

A network protocol defines rules that control communications between two or more machines on the Internet, whereas Automatic Protocol Reverse Engineering (APRE) defines the way of extracting the structure of a network protocol without accessing its specifications. Enough knowledge on undocumented protocols is essential for security purposes, network policy implementation, and management of network resources. This paper reviews and analyzes a total of 39 approaches, methods, and tools towards Protocol Reverse Engineering (PRE) and classifies them into four divisions, approaches that reverse engineer protocol finite state machines, protocol formats, and both protocol finite state machines and protocol formats to approaches that focus directly on neither reverse engineering protocol formats nor protocol finite state machines. The efficiency of all approaches’ outputs based on their selected inputs is analyzed in general along with appropriate reverse engineering inputs format. Additionally, we present discussion and extended classification in terms of automated to manual approaches, known and novel categories of reverse engineered protocols, and a literature of reverse engineered protocols in relation to the seven layers’ OSI (Open Systems Interconnection) model.

NetPlier: Probabilistic Network Protocol Reverse Engineering from Message Traces

“…Protocol Reverse Engineering. Protocol reverse engineering targets at inferring the specification of unknown network protocols for further security evaluation [56], [63], [37], [73]. There are two main categories, either by program analysis [28], [57], [82], [33], [59], [32] or by network traces [22], [55], [35], [52], [81], [51], [80], [26], [38], [47].…”

Two-Pathway Model for Enhancement of Protocol Reverse Engineering

“…For instance, protocol reverse engineering can be helpful for firewalls and intrusion detection systems to detect and block previously unknown attacks. It can also be used for penetration testing, can be used in a smart fuzzing operation to identify network vulnerabilities, and can provide useful information as part of deep packet inspection (DPI) to analyze malware protocols [4]. However, in order to provide this information, an in-depth understanding of the protocol is first required, and the underlying technology is protocol reverse engineering [5].…”

Extracting Vehicle Sensor Signals from CAN Logs for Driver Re-identification

“…As signal positions, lengths and coding are proprietary and vary among makes, models, model years and even geographical area, first, we have to interpret the messages. We emphasize that we do not intend to perform (an even remotely) comprehensive reverse engineering Sija et al (2018); we focus solely on a small number of sensor signals which are good descriptors of natural driving behavior.…”