NetPlier: Probabilistic Network Protocol Reverse Engineering from Message Traces

Abstract

Network protocol reverse engineering is an important challenge with many security applications. A popular kind of method leverages network message traces. These methods rely on pair-wise sequence alignment and/or tokenization. They have various limitations such as difficulties of handling a large number of messages and dealing with inherent uncertainty. In this paper, we propose a novel probabilistic method for network trace based protocol reverse engineering. It first makes use of multiple sequence alignment to align all messages and then reduces the problem to identifying the keyword field from the set of aligned fields. The keyword field determines the type of a message. The identification is probabilistic, using random variables to indicate the likelihood of each field (being the true keyword). A joint distribution is constructed among the random variables and the observations of the messages. Probabilistic inference is then performed to determine the most likely keyword field, which allows messages to be properly clustered by their true types and enables the recovery of message format and state machine. Our evaluation on 10 protocols shows that our technique substantially outperforms the state-of-the-art and our case studies show the unique advantages of our technique in IoT protocol reverse engineering and malware analysis.

IMCSA: Providing Better Sequence Alignment Space for Industrial Control Protocol Reverse Engineering

“…In particular, Netplier [19] is the most representative scheme in recent years. In 2021, Ye et al [19] proposed Netplier for the keyword extraction problem.…”

“…In particular, Netplier [19] is the most representative scheme in recent years. In 2021, Ye et al [19] proposed Netplier for the keyword extraction problem. By introducing multiple constraint relations and posterior probabilities, Netplier selects the candidate with the highest probability as the keyword.…”

“…Heuristic. By analyzing the design specifcations of most public industrial control protocols, we propose two types of protocol characteristics: inter and intra-message characteristics [7,19,29].…”

“…For each protocol, we fltered 300 messages for the experiment except Heart due to lack of enough messages. Moreover, we used Netplier [19] which introduced a posteriori probabilities to detect true keywords and obtain the true format, to extract the true format of the messages in the dataset.…”

“…However, there are still some problems with the reverse analysis of industrial control protocols based on sequence alignment, especially in terms of time overhead. However, most existing related works [13][14][15][16][17][18][19][20] focus on how to introduce additional information to improve the accuracy of the format extraction results, while ignoring the potentially signifcant overhead. Terefore, we conducted a study to improve the efciency of the algorithm.…”