Automatic network protocol message format analysis
Mingming Xiao, Shilong Zhang, Yu-Ping Luo · Journal of Intelligent & Fuzzy Systems · 2016
An effective method for reverse engineering message format specification is proposed, which is a necessary step to extract the protocol’s state machine. First, separators are scanned and compared to accomplish protocol fields partitioned hierarchically, so as to determine the field boundaries recur sively and achieve the basic field; second, the protocol candidate tokens are extracted by frequency statistics; finally, the logic feature selector is designed for filtering the logic feature keywords. The experimental valuation demonstrates the validation of partitioning fields and extracting logic feature keyword.