BinaryInferno: A Semantic-Driven Approach to Field Inference for Binary Message Formats

Chandler, Jared; Wick, Adam; Fisher, Kathleen

doi:10.14722/ndss.2023.23131

Cited by 5 publications

(7 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Table II shows the protocols selected for evaluation. We selected them by referring to prior research [53], [9] and considering various characteristics. Regarding ownership, S7comm, SMB, and SMB2 are proprietary, initially closed protocols, while the others are open protocols.…”

Section: A Experiments Setupmentioning

confidence: 99%

“…Compared Tools. We select five state-of-the-art protocol reverse engineering tools widely used in academia and industry as baselines, including Netzob [6], Netplier [53], FieldHunter [3], BinaryInferno [9], and Nemesys [22]. Their approaches are diverse.…”

Section: A Experiments Setupmentioning

confidence: 99%

“…Metrics for format inference. We employ metrics from recent work [53], [9] and divide them into two categories, i.e., one-and two-dimensional metrics, categorized by whether they are from a byte or field perspective. (i) The one-dimensional metric evaluates each byte boundary individually as either a field boundary or not (i.e., a binary classification).…”

Section: A Experiments Setupmentioning

confidence: 99%

“…For instance, analyzing protocols in embedded systems presents challenges in acquiring and emulating firmware. Network trace based approaches, on the other hand, take static network traces as input and perform statistical analysis [53], [6], [9], [12], [3]. They use techniques such as message sequence alignment to mine the format characteristics messages exhibit in the traces.…”

Section: Introductionmentioning

confidence: 99%

“…The experimental results demonstrate that DYNPRE outperforms prior approaches in both field identification and message type inference. Specifically, DYN-PRE identifies fields with a perfection score of 0.50 and infers message types with a V-measure of 0.94, whereas Netzob [6], Netplier [53], FieldHunter [3], BinaryInferno [9], and Nemesys [22] achieve on average (0.15, 0.72), (0.16, 0.73), (0.15, 0.83), (0.15, -), and (0.31, -), respectively. Even when these tools are given datasets enhanced with dynamic interaction, DYNPRE is still superior.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

DynPRE: Protocol Reverse Engineering via Dynamic Inference

Luo,

Liang,

Zhao

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Automatic protocol reverse engineering is essential for various security applications. While many existing techniques achieve this task by analyzing static network traces, they face increasing challenges due to their dependence on high-quality samples. This paper introduces DYNPRE, a protocol reverse engineering tool that exploits the interactive capabilities of protocol servers to obtain more semantic information and additional traffic for dynamic inference. DYNPRE first processes the initial input network traces and learns the rules for interacting with the server in different contexts based on session-specific identifier detection and adaptive message rewriting. It then applies exploratory request crafting to obtain semantic information and supplementary samples and performs real-time analysis. Our evaluation on 12 widely used protocols shows that DYNPRE identifies fields with a perfection score of 0.50 and infers message types with a V-measure of 0.94, significantly outperforming state-of-the-art methods like Netzob, Netplier, FieldHunter, BinaryInferno, and Nemesys, which achieve average perfection and V-measure scores of (0.15, 0.72), (0.16, 0.73), (0.15, 0.83), (0.15, -), and (0.31, -), respectively. Furthermore, case studies on unknown protocols highlight the effectiveness of DYNPRE in real-world applications.

show abstract

Section: A Experiments Setupmentioning

confidence: 99%

Section: A Experiments Setupmentioning

confidence: 99%

Section: A Experiments Setupmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

DynPRE: Protocol Reverse Engineering via Dynamic Inference

Luo,

Liang,

Zhao

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

ProInfer: inference of binary protocol keywords based on probabilistic statistics

Guo,

Zhu,

Fei

2024

The Computer Journal

View full text Add to dashboard Cite

Protocol reverse engineering is crucial in normative verification, and malware behavior analysis and vulnerability discovery. However, uncovering the structural features of binary protocols concealed within dense data representations remains a significant challenge. Accurately identifying keyword segments associated with message types is a prerequisite for meaningful semantic analysis and protocol state machine reduction. In this work, we introduce a novel approach for inferring keywords from binary protocols based on probabilistic statistics. Our method in terms of Byte employs heuristic rules to filter offset positions that are clearly unrelated to message types. We further filter candidate Byte-offsets utilizing constraint relations and provide the probabilistic ranking of each offset as the keyword segment. To enhance the reliability of keyword segment inference, we utilize the Monte Carlo algorithm to assess the difference between message clustering with candidate Byte-offset and random message clustering, and reorder candidate offsets according to the results. Then we can observe optimal values from both orderings and present the ultimate inference results. Experimental results demonstrate that our method excels in the accuracy of keyword segments identification compared with previous techniques.

show abstract