Prospex: Protocol Specification Extraction

摘要: Protocol reverse engineering is the process of extracting application-level specifications for network protocols. Such are very useful in a number security-related contexts, example, to perform deep packet inspection and black-box fuzzing, or quickly understand custom botnet command control (C\&C) channels.Since manual time-consuming tedious process, systems have been proposed that aim automate this task. These either analyze traffic directly monitor execution application receives protocol messages. While previous show precise message formats can be extracted automatically, they do not provide specification.The reason engineer state machine.In paper, we focus on closing gap by presenting system capable automatically inferring machines. This greatly enhances results automatic engineering, while further reducing need human interaction. We extend work focuses behavior-based format extraction,and introduce techniques identifying clustering different types messages only based their structure, but also according impact each server behavior.Moreover, present an algorithm machine.We applied our real-world protocols, including used malicious bot. Our demonstrate able extract meaningful use these generate input stateful fuzzer,allowing us discover security vulnerabilities applications.