Towards automated protocol reverse engineering using semantic information

Bossert, Georges; Guihéry, Frédéric; Hiet, Guillaume

doi:10.1145/2590296.2590346

Cited by 75 publications

(88 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Then, we extract the binary format of the takeoff commands using Protocol Informatics [18], which requires 0.03 s. In addition to the keywords shown in Table 1, there are two dynamic fields in the command, as shown in Figure 6.…”

Section: Discussionmentioning

confidence: 99%

“…Li and Yu [16] mined keywords of private protocols tunneled over WebSocket using a hidden semi-Markov model [17] based on network traces. However, methods proposed in previous work are often unavailable to the scientific community [18]. Netzob [18] is an open-source protocol reverse-engineering tool for analyzing protocol message formats and protocol state machines.…”

Section: Related Workmentioning

confidence: 99%

“…However, methods proposed in previous work are often unavailable to the scientific community [18]. Netzob [18] is an open-source protocol reverse-engineering tool for analyzing protocol message formats and protocol state machines. This protocol features high accuracy when analyzing complex communication protocols.…”

Section: Related Workmentioning

confidence: 99%

“…Approaches based on network traces mentioned in [11,12,[14][15][16]18] focus on network communication protocols such as ICMP, FTP, DNS, or certain undocumented communication protocols running on botnets instead of UAV flight control protocols. As a result, the approaches described above cannot be used for reverse engineering of private flight control protocols for UAVs directly, and they cannot extract the meaning of flight control commands.…”

Section: Related Workmentioning

confidence: 99%

See 3 more Smart Citations

Automatic Reverse Engineering of Private Flight Control Protocols of UAVs

Jian

Tang

et al. 2017

Security and Communication Networks

View full text Add to dashboard Cite

The increasing use of civil unmanned aerial vehicles (UAVs) has the potential to threaten public safety and privacy. Therefore, airspace administrators urgently need an effective method to regulate UAVs. Understanding the meaning and format of UAV flight control commands by automatic protocol reverse-engineering techniques is highly beneficial to UAV regulation. To improve our understanding of the meaning and format of UAV flight control commands, this paper proposes a method to automatically analyze the private flight control protocols of UAVs. First, we classify flight control commands collected from a binary network trace into clusters; then, we analyze the meaning of flight control commands by the accumulated error of each cluster; next, we extract the binary format of commands and infer field semantics in these commands; and finally, we infer the location of the check field in command and the generator polynomial matrix. The proposed approach is validated via experiments on a widely used consumer UAV.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

Automatic Reverse Engineering of Private Flight Control Protocols of UAVs

Jian

Tang

et al. 2017

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…There are two common approaches for inferring protocol specifications: (1) by reverse engineering protocol executables (e.g., using dynamic execution analysis of the server while processing messages) [6], [7], [10], [13], [43], or (2) by analysing network traffic [2], [3], [4], [11], [23], [40], [42]. The choice of approach invariably depends on the context.…”

Section: Protocol Reverse Engineeringmentioning

confidence: 99%

Using Segment-Based Alignment to Extract Packet Structures from Network Traces

Esoul

Walkinshaw

2017

2017 IEEE International Conference on Software Quality, Reliability and Security (QRS)

View full text Add to dashboard Cite

Abstract-Many applications in security, from understanding unfamiliar protocols to fuzz-testing and guarding against potential attacks, rely on analysing network protocols. In many situations we cannot rely on access to a specification or even an implementation of the protocol, and must instead rely on raw network data "sniffed" from the network. When this is the case, one of the key challenges is to discern from the raw data the underlying packet structures -a task that is commonly carried out by using alignment algorithms to identify commonalities (e.g. field delimiters) between packets. For this, most approaches have used variants of the Needleman Wunsch algorthm to perform byte-wise alignment. However, they can suffer when messages are heterogeneous, or in cases where protocol fields are separated by long variable fields. In this paper, we present an alternative alignment algorithm known as segment-based alignment. We show how this technique can produce accurate results on traces from several common protocols, and how the results tend to be more intuitive than those produced by state-of-the-art techniques.

show abstract

A message keyword extraction approach by accurate identification of field boundaries

Goo

Shim

Lee³

et al. 2020

Int J Network Mgmt

View full text Add to dashboard Cite

Summary With the recent exponential increase in internet speeds, the traditional network environment is evolving into a high‐capacity network environment. Network traffic usage is also increasing exponentially, as are new malicious behaviors and related applications. Most of these applications and malicious behaviors use unknown protocols for which the structure is inaccessible; hence, protocol reverse engineering is receiving increasing attention in the field of network management. Various approaches have been proposed, but they still suffer from misidentification of field boundaries. To understand message structures properly, it is important to identify accurately the boundaries of the fields constituting the protocol message; accurate keyword extraction based on this approach leads to the correct inference of message types, semantics, and state machine. In this study, we propose a message keyword extraction method using accurate identification of field boundaries from delimiter inference and statistical analysis. Through the identification of field boundaries, messages can be subdivided into fields. We evaluate the efficacy of the proposed method by applying it to several textual and binary protocols. The proposed method showed better results than did other previous studies for both textual and binary protocols.

show abstract

Towards automated protocol reverse engineering using semantic information

Cited by 75 publications

References 13 publications

Automatic Reverse Engineering of Private Flight Control Protocols of UAVs

Automatic Reverse Engineering of Private Flight Control Protocols of UAVs

Using Segment-Based Alignment to Extract Packet Structures from Network Traces

A message keyword extraction approach by accurate identification of field boundaries

Contact Info

Product

Resources

About