Automatic protocol reverse-engineering: Message format extraction and field semantics inference

摘要: Understanding the command-and-control (C&C) protocol used by a botnet is crucial for anticipating its repertoire of nefarious activity. However, C&C protocols botnets, similar to many other application layer protocols, are undocumented. Automatic reverse-engineering techniques enable understanding undocumented and important security applications, including analysis defense against botnets. For example, they active infiltration, where analyst rewrites messages sent received bot in order contain malicious activity provide botmaster with an illusion successful unhampered operation. In this work, we propose novel approach automatic reverse engineering based on dynamic program binary analysis. Compared previous work that examines network traffic, leverage availability implements protocol. Our extracts more accurate complete information enables encrypted protocols. extract message format field semantics unknown specification. We implement our into tool called Dispatcher use it analyze previously MegaD, spam at peak produced one third Internet.