Automatic Reverse Engineering Method for Extracting Well-trimmed Protocol Specification

Abstract

Emergence of high-speed Internet and ubiquitous environment has led to a rapid increase of applications and malicious behaviors with various functions. Many of the complex and diverse protocols that occur under these situations, are unknown protocols that are at least documented. For efficient network management and network security, protocol reverse engineering that extract the specification of the protocols is very important. While various protocol reverse engineering methods are being studied, each of methods has some limitations. In this paper, we propose the reverse engineering method for extracting well-trimmed protocol specification. The proposed method can extract intuitive field formats, message formats with semantics, flow formats, and protocol state machine of the unknown protocol. We implement our approach in a prototype system and demonstrate the validity of our approach through experimenting it over HTTP protocol.