A Study on the Method to Extract Clear Fields From the Private Protocol
Min‐Seob Lee, Kyuseok Shim, Young‐Hoon Goo, Myung‐Sup Kim · 2018
The computer network environment has been growing steadily in recent years, and as a result there has been continuous high volume of network traffic. Several applications and malicious behavior are emerging as networks are being used in many areas. As a result, applications and malicious behavior using private protocols continue to grow, and most of their private protocols are unknown or not documented. Analyzing the structure of private protocols to respond to malicious behavior or to construct an efficient network environment is an essential study in modern society. The method by which protocols are analyzed is called Protocol Reverse Engineering, and its importance has already been proven to date. While various studies address Protocol Reverse Engineering, there is no standardized way to distinguish or extract the fields that make up the protocol. Therefore, this paper proposes and validates how fields are extracted from private protocols using the Apriori Algorithm, one of the sequential pattern mining techniques.