Bit-oriented format extraction approach for automatic binary protocol reverse engineering

摘要: Protocol message format extraction is a principal process of automatic network protocol reverse engineering when target specifications are not available. However, binary has been new challenge in recent years for approaches that traditionally have dealt with text-based protocols rather than protocols. In this study, the authors propose novel approach called PRE-Bin automatically extracts binary-type fields based on fine-grained bits. First, silhouette coefficient introduced into hierarchical clustering to confirm optimal number frames. Second, modified multiple sequence alignment algorithm, which matching and back-tracing rules redesigned, also proposed analyse field features. Finally, Bayes decision model invoked describe features determine bit-oriented boundaries. The maximum posteriori criterion leveraged complete an estimation implemented prototype system infer specification from actual traffic traces. Experimental results indicate effectively outperforms existing algorithms.