Reverse Engineering of Protocols from Network Traces

摘要: Communication protocols determine how network components interact with each other. Therefore, the ability to derive a specification of protocol can be useful in various contexts, such as support deeper black-box testing or effective defense mechanisms. Unfortunately, it is often hard obtain because systems implement closed (i.e., undocumented) protocols, time consuming translation has performed, from textual description format readable by tools. To address these issues, we propose new methodology automatically infer traces, which generates automata for language and state machine. Since our solution only resorts interaction samples protocol, well-suited uncover message formats states also automate most process specifying open protocols. The approach was implemented tool experimentally evaluated publicly available FTP traces. Our results show that inferred good approximation reference specification, exhibiting high level precision recall.