Text-based Protocol Research Articles

Network Communication Protocol Reverse Engineering Based on Auto-Encoder

Network communication protocol reverse engineering is useful for network security, including protocol fuzz testing, botnet command infiltration, and service script generation. Many models have been proposed to generate field boundary, field semantic, state machine, and some other format information from network trace and program execution for text-based protocol and hybrid protocols. However, how to extract format information from network trace data for binary-based protocol still remains a challenging issue. Existing network-trace-based models focus on text-based and hybrid protocols, using tokenization and some other heuristic rules, like field identification, to perform reverse engineering, which makes it hard to apply to binary-based protocol. In this paper, we propose a whole mechanism for binary-based protocol reverse engineering based on auto-encoder models and other clustering algorithms using only network trace data. After evaluation, we set some metrics and compare our model with existing other models, showing its necessity to the field of protocol reverse engineering.

Facilitating Taiwanese Elementary School English Student Teachers’ Learning Through Text-Based Protocols

This study used online responses, observation fieldnotes, and interviews to analyze eight student teachers’ learning through text-based protocols on news analysis during their practicum, a core component for beginning teachers’ competence construction, in a language teacher education program in the northwest of Taiwan. This study revealed that student teachers regarded the text-based protocols as useful pedagogical tools, particularly offering a clear focus on reading and analyzing the news. Through face-to-face and Facebook discussions on 33 news reports, student teachers became familiar with the latest policies and trends on English education, constructed their pedagogical competence in English instructional strategies, and examined the gap between policies and practice on the co-teaching model. Suggestions on effective implementation of the text-based protocols on discussing education news are provided in terms of preparation of a variety of news or issues, selection of the appropriate text-based protocols, and integration of theories on news analysis and discussions.

Informing Content and Feature Design of a Parent-Focused Human Papillomavirus Vaccination Digital Behavior Change Intervention: Synchronous Text-Based Focus Group Study.

BackgroundHuman papillomavirus (HPV) is a common and preventable sexually transmitted infection; however, vaccination rates in the United States among the target age group, which is 11-12 years, are lower than national goals. Interventions that address the barriers to and facilitators of vaccination are important for improving HPV vaccination rates. Web-based, text-based focus groups are becoming a promising method that may be well suited for conducting formative research to inform the design of digital behavior change intervention (DBCI) content and features that address HPV vaccination decision-making.ObjectiveThis study aims to explore parental HPV vaccination decision-making processes using a web-based, text-based focus group protocol to inform content and feature recommendations for an HPV prevention DBCI.MethodsWe conducted 4 web-based, text-based synchronous focus groups via Skype with the parents of patients aged 11-13 years within a large urban US pediatric clinic network.ResultsThe 22 parents were mostly female, White, non-Hispanic college graduates, and they mostly had private health insurance for their children. Approximately half (14/25, 56%) of the parents' 11-13 year old children had initiated HPV vaccination. Most parents had experience using Skype (19/22, 86%). Approximately half (8/17, 47%) of parents expressed no preference for the focus group format, whereas 47% (8/17) requested a text-only chat format and 6% (1/17) requested an audiovisual format. The three main themes from the qualitative data were barriers to HPV vaccination, facilitators of HPV vaccination, and suggestions for improving the HPV vaccination clinic experience. A total of 11 intervention content and feature recommendations emerged from the themes, including addressing HPV knowledge barriers using trusted sources, designing for a family audience, focusing on the framing of messages, reporting reputable HPV research in a comprehensible format, and expanding the clinic visit experience.ConclusionsSynchronous text-based focus groups are feasible for conducting formative research on HPV vaccination decision-making. Among well-educated and well-resourced parents, there are barriers such as misinformation and facilitators such as pediatrician recommendations that influence HPV vaccination decision-making. Parents want to conduct their own HPV research as well as receive relevant HPV vaccination advice from their child’s pediatrician. In addition, parents want an enhanced clinic visit experience that lets them access and connect to tailored information before and after clinic visits. The results gathered provide guidance for content and features that may inform a more responsive DBCI to address HPV vaccination decision-making among parents.

Survey of Countering DoS/DDoS Attacks on SIP Based VoIP Networks

Voice over IP (VoIP) services hold promise because of their offered features and low cost. Most VoIP networks depend on the Session Initiation Protocol (SIP) to handle signaling functions. The SIP is a text-based protocol that is vulnerable to many attacks. Denial of Service (DoS) and distributed denial of service (DDoS) attacks are the most harmful types of attacks, because they drain VoIP resources and render SIP service unavailable to legitimate users. In this paper, we present recently introduced approaches to detect DoS and DDoS attacks, and classify them based on various factors. We then analyze these approaches according to various characteristics; furthermore, we investigate the main strengths and weaknesses of these approaches. Finally, we provide some remarks for enhancing the surveyed approaches and highlight directions for future research to build effective detection solutions.

Countering DDoS Attacks in SIP Based VoIP Networks Using Recurrent Neural Networks.

Many companies have transformed their telephone systems into Voice over IP (VoIP) systems. Although implementation is simple, VoIP is vulnerable to different types of attacks. The Session Initiation Protocol (SIP) is a widely used protocol for handling VoIP signaling functions. SIP is unprotected against attacks because it is a text-based protocol and lacks defense against the growing security threats. The Distributed Denial of Service (DDoS) attack is a harmful attack, because it drains resources, and prevents legitimate users from using the available services. In this paper, we formulate detection of DDoS attacks as a classification problem and propose an approach using token embedding to enhance extracted features from SIP messages. We discuss a deep learning model based on Recurrent Neural Networks (RNNs) developed to detect DDoS attacks with low and high-rate intensity. For validation, a balanced real traffic dataset was built containing three attack scenarios with different attack durations and intensities. Experiments show that the system has a high detection accuracy and low detection time. The detection accuracy was higher for low-rate attacks than that of traditional machine learning.

DPFEE: A High Performance Scalable Pre-Processor for Network Security Systems

Network Intrusion Detection Systems (NIDS) and Anti-Denial-of-Service (DoS) employ Deep Packet Inspection (DPI) which provides visibility to the content of payload to detect network attacks. All DPI engines assume a pre-processing step that extracts the various protocol-specific fields. However, application layer (L7) field extraction is computationally expensive. We propose a novel Deep Packet Field Extraction Engine (DPFEE) for application layer field extraction to hardware. DPFEE is a content-aware, grammar-based, Layer 7 programmable field extraction engine for text-based protocols. Our prototype DPFEE implementation for the Session Initiation Protocol (SIP) and HTTP protocol on a single FPGA, achieves a bandwidth of 408.5 Gbps and this can be scaled beyond 500 Gbps. Single DPFEE exhibits a speedup of 24X-89X against widely used preprocessors. Even against 12 multi-instances of a preprocessor, single DPFEE demonstrated a speedup of 4.7-7.4X. Single DPFEE achieved 3.14X higher bandwidth, 1020X lower latency, and 106X lower power consumption, when compared with 200 parallel streams of GPU accelerated preprocessor.

Detecting Anomalous Behavior in VoIP Systems: A Discrete Event System Modeling

Session initiation protocol (SIP) is an application layer protocol used for signaling purposes to manage voice over IP connections. SIP being a text-based protocol is vulnerable to a range of denial of service (DoS) attacks. These DoS attacks can render the SIP servers/SIP proxy servers unusable by depleting memory and CPU time. In this paper, we consider two types of DoS attacks, namely, flooding attacks and coordinated attacks for detection. Flooding attacks affect both stateless and stateful SIP servers while coordinated attacks affect stateful SIP servers. We model the SIP operation as discrete event system (DES) and design a new state transition machine, which we name as probabilistic counting deterministic timed automata (PCDTA) to describe the behavior of SIP operations. We also identify different types of anomalies that can occur in a DES model, which appear in the form of illegal transitions, violating timing constraints, and appear in number which is otherwise not seen. Subsequently, we map various DoS attacks in SIP to a type of anomaly in DES. PCDTA can learn probabilities of various transitions and timings delay from a set of nonmalicious training sequences. A trained PCDTA can detect anomalies, and hence various DoS attacks in SIP. We perform a thorough experiment with computer simulated SIP traffic and report the detection performance of PCDTA on various attacks generated through custom scripts.

Optimizing Libraries’ Content Findability Using Simple Object Access Protocol (SOAP) With Multi-Tier Architecture

The aim of this paper is to describe a developed application of Simple Object Access Protocol (SOAP) as a model for improving libraries’ digital content findability on the library web. The study applies XML text-based protocol tools in the collection of data about libraries’ visibility performance in the search results of the book. Model from the integrated Web Service Document Language (WSDL) and Universal Description, Discovery and Integration (UDDI) are applied to analyse SOAP as element within the system. The results showed that the developed application of SOAP with multi-tier architecture can help people simply access the website in the library server Gorontalo Province and support access to digital collections, subscription databases, and library catalogs in each library in Regency or City in Gorontalo Province.

Review of SIP based DoS attacks

The Voice over Internet Protocol (VoIP). The VoIP is relatively new and is gaining more and more popularity as it offers a wide range of features and is much more cost effective as compared to the traditional PSTN. But the VoIP brings with it certain security threats which need to be resolved in order to make it a more reliable source of communication. Session Initiation Protocol (SIP) today is considered the standard protocol for multimedia signaling, and the result is a very generic protocol. SIP is specified by the IETF in RFC 3261. From a structural and functional perspective, SIP is application layer signaling text-based protocol used for creating, modifying, and terminating multimedia communications sessions among Internet endpoints. Unfortunately, SIP-based application services can suffer from various security threats as Denial of Service (DoS). attacks on a SIP based VoIP infrastructure that can severely compromise its reliability. In contrast, little work is done to analyze the robustness and reliability of SIP severs under DoS attacks. In this survey, we are discussing the DoS flooding attack on SIP server. Firstly, we present a brief overview about the SIP protocol. Then, security attacks related to SIP protocol. After that, detection techniques of SIP flooding attack and various exploited resources due to attack were discussed and finally the paper reviews previous work done on SIP based DoS attacks

A Flexible SoC and Its Methodology for Parser-Based Applications

Embedded systems are being increasingly network interconnected. They are required to interact with their environment through text-based protocol messages. Parsing such messages is control dominated. The work presented in this article attempts to accelerate message parsers using a codesign-based approach. We propose a generic architecture associated with an automated design methodology that enables SoC/SoPC system generation from high-level specifications of message protocols. Experimental results obtained on a Xilinx ML605 board show acceleration factors ranging from four to 11. Both static and dynamic reconfigurations of coprocessors are discussed and then evaluated so as to reduce the system hardware complexity.

Detecting zero-day attacks using context-aware anomaly detection at the application-layer

Anomaly detection allows for the identification of unknown and novel attacks in network traffic. However, current approaches for anomaly detection of network packet payloads are limited to the analysis of plain byte sequences. Experiments have shown that application-layer attacks become difficult to detect in the presence of attack obfuscation using payload customization. The ability to incorporate syntactic context into anomaly detection provides valuable information and increases detection accuracy. In this contribution, we address the issue of incorporating protocol context into payload-based anomaly detection. We present a new data representation, called $${c}_n$$ -grams, that allows to integrate syntactic and sequential features of payloads in an unified feature space and provides the basis for context-aware detection of network intrusions. We conduct experiments on both text-based and binary application-layer protocols which demonstrate superior accuracy on the detection of various types of attacks over regular anomaly detection methods. Furthermore, we show how $${c}_n$$ -grams can be used to interpret detected anomalies and thus, provide explainable decisions in practice.

Bit‐oriented format extraction approach for automatic binary protocol reverse engineering

Protocol message format extraction is a principal process of automatic network protocol reverse engineering when target protocol specifications are not available. However, binary protocol reverse engineering has been a new challenge in recent years for approaches that traditionally have dealt with text-based protocols rather than binary protocols. In this study, the authors propose a novel approach called PRE-Bin that automatically extracts binary-type fields of binary protocols based on fine-grained bits. First, a silhouette coefficient is introduced into the hierarchical clustering to confirm the optimal clustering number of binary frames. Second, a modified multiple sequence alignment algorithm, in which the matching process and back-tracing rules are redesigned, is also proposed to analyse binary field features. Finally, a Bayes decision model is invoked to describe field features and determine bit-oriented field boundaries. The maximum a posteriori criterion is leveraged to complete an optimal protocol format estimation of binary field boundaries. The authors implemented a prototype system of PRE-Bin to infer the specification of binary protocols from actual traffic traces. Experimental results indicate that PRE-Bin effectively extracts binary fields and outperforms the existing algorithms.

Refinement типы для языка Jolie

Jolie is the first language for microservices and it is currently dynamically type checked. This paper considers the opportunity to integrate dynamic and static type checking with the introduction of refinement types, verified via an SMT solver. The integration of the two aspects allows a scenario where the static verification of internal services and the dynamic verification of (potentially malicious) external services cooperate in order to reduce testing effort and enhance security. Refinement types are well-known technique for numeric, array and algebraic data types. They rely on corresponding SMT-theories. Recently SMT solvers got support for a theory of strings and regular expressions. In the paper, we describe possible application of the theory to string refinement types. We use Jolie programming language to illustrate feasibility and usefulness of such extension. First, because Jolie already has syntax extension to support string refinements. We build on top of that extension to provide static type checking. Second, because in the realm of microservices the need for improved checking of string data is much higher as most of external communication goes through text-based protocols. We present simplified but real-world example from the domain of web-development. We intentionally introduce a bug in the example demonstrating how easily it can slip a conventional type system. Proposed solution is feasible, as it do not accept program with the bug. Complete solution will need enhancements in precision and error reporting.

A single round-trip SIP authentication scheme for Voice over Internet Protocol using smart card

The Session Initiation Protocol (SIP) has revolutionized the way of controlling Voice over Internet Protocol (VoIP) based communication sessions over an open channel. The SIP protocol is insecure for being an open text-based protocol inherently. Different solutions have been presented in the last decade to secure the protocol. Recently, Zhang et al. authentication protocol has been proposed with a sound feature that authenticates the users without any password-verifier database using smart card. However, the scheme has a few limitations and can be made more secure and optimized regarding cost of exchanged messages, with a few modifications. Our proposed key-agreement protocol makes a use of two server secrets for robustness and is also capable of authenticating the involved parties in a single round-trip of exchanged messages. The server can now authenticate the user on the request message received, rather than the response received upon sending the challenge message, saving another round-trip of exchanged messages and hence escapes a possible denial of service attack.

SIP Security: Main Vulnerabilities, Denial of Service (DoS) Attacks and Intrusion Detection Techniques

Session Initiation Protocol (SIP) is application layer signaling text-based protocol used for creating, modifying, and terminating multimedia communications sessions (Internet telephone calls, instant messaging, and multimedia conferences) among Internet endpoints. SIP is defined by the Internet Engineering Task Force (IETF) and documented in RFC 3261. Unfortunately, SIP-based application services using IP network are not only exposed to the security vulnerabilities inherited from IP but also exposed to new security vulnerabilities inherited from SIP. In this paper we present the most important security vulnerabilities, threats, and attacks against SIP- multimedia communications systems. Our goal is to provide roadmap to the interested persons for understanding existing capabilities, and identifying the gaps and vulnerabilities in SIP, We illustrate how these vulnerabilities can be exploited to compromise the security of SIP-based systems. Then we focus on Denial of Service (DoS) attacks that impact service availability along with the main detection techniques for these attacks.

Position-based automatic reverse engineering of network protocols

Automatic protocol reverse engineering is a process of extracting protocol message formats and protocol state machine without access to the specification of target protocol. Protocol reverse engineering is useful for addressing many problems of network management and security, such as network management, honey-pot systems, intrusion detection, Botnet detection and prevention, and so on. Currently, protocol reverse engineering is mainly a manual and painstaking process which is time-consuming and error-prone. In this paper, we present a novel approach for automatic reverse engineering application-layer network protocols. We extract protocol keywords from network traces based on their support rates and variances of positions, reconstruct message formats, and infer protocol state machines. We implement our approach in a prototype system called AutoReEngine and evaluate it over four text-based protocols (HTTP, POP3, SMTP and FTP) and two binary protocols (DNS and NetBIOS). The results show that our AutoReEngine outperforms the existing algorithms.

Zebra: Building Efficient Network Message Parsers for Embedded Systems

Supporting standard text-based protocols in embedded systems is challenging because of the often limited computational resources that embedded systems provide. To overcome this issue, a promising approach is to build parsers directly in the hardware. Unfortunately, developing such parsers is a daunting task for most developers as it is at the crossroads of several areas of expertise, such as low-level network programming or hardware design. In this letter, we propose Zebra, a generative approach that drastically eases the development of hardware parsers and their use in network applications. To validate our approach, we used Zebra to generate hardware parsers for widely used protocols, including HTTP, SMTP, SIP, and RTSP. Our experiments show that Zebra-based parsers are up to 11 times faster than software-based parsers.

Using a Text-Based Verbal Protocol to Elicit Secondary English Teachers' Perspectives on New Literacies

This article reports on the use of a text-based verbal protocol (Afflerbach, 2000) situated within individual interviews to elicit secondary English teachers' perspectives on new literacies (Albers & Harste, 2007; Coiro, Knobel, Lankshear, & Leu, 2008). Ranging significantly in their teaching experience and comfort with new media and digital technologies, the 16 participants were affiliated with the English department in a well-respected suburban high school in the northeast United States. Protocol data were supplemented by brief researcher-designed questionnaires and focus group interviews. The article provides background about verbal protocols; discusses how the protocol for the study was designed; shares patterns from the protocol-related data; proposes adjustments to maximize benefits and address constraints associated with the approach for future research; and discusses the significance of this work for literacy researchers.

Improving Anomaly Detection for Text-Based Protocols by Exploiting Message Structures

Service platforms using text-based protocols need to be protected against attacks. Machine-learning algorithms with pattern matching can be used to detect even previously unknown attacks. In this paper, we present an extension to known Support Vector Machine (SVM) based anomaly detection algorithms for the Session Initiation Protocol (SIP). Our contribution is to extend the amount of different features used for classification (feature space) by exploiting the structure of SIP messages, which reduces the false positive rate. Additionally, we show how combining our approach with attribute reduction significantly improves throughput.

Whisker: A client—server high-performance multimedia research control system

We describe an original client-server approach to behavioral research control and the Whisker system, a specific implementation of this design. The server process controls several types of hardware, including digital input/output devices, multiple graphical monitors and touchscreens, keyboards, mice, and sound cards. It provides a way to access this hardware for client programs, communicating with them via a simple text-based network protocol based on the standard Internet protocol. Clients to implement behavioral tasks may be written in any network-capable programming language. Applications to date have been in experimental psychology and behavioral and cognitive neuroscience, using rodents, humans, nonhuman primates, dogs, pigs, and birds. This system is flexible and reliable, although there are potential disadvantages in terms of complexity. Its design, features, and performance are described.