Automatic Network Protocol Automaton Extraction

摘要: Protocol reverse engineering, the process of (re)constructing protocol context communication sessions by an implementation, which involves translating a sequence packets into messages, grouping them sessions, and modeling state transitions in machine, is well-known to be invaluable for many network security applications, including intrusion prevention detection, traffic normalization, penetration testing, etc. However, current practice deriving specifications either mostly manual or focusing on automatic engineering message format only leaving machine inverse undone. Although regular expressions offer superior expressive ability flexibility, application protocols are described expression manually based sufficiently understanding itself. At present there not effect method realize classification, recognition control automatically known applications unknown future. In this paper novel approach presented model specification. work, whole realized through accomplishing then FSMs translated corresponding enrich update pattern database. This uses grammatical inference motivated observation that implementation inherently transition process, essence exactly. The important significance describe various with common transition, ones. had been implemented system evaluated using real-world implementations three different protocols: HTTP, SMTP, FTP, compared extracted other newly system, such as l7-filter.