Sciweavers

Share
NDSS
2008
IEEE

Automatic Protocol Format Reverse Engineering through Context-Aware Monitored Execution

9 years 10 months ago
Automatic Protocol Format Reverse Engineering through Context-Aware Monitored Execution
Protocol reverse engineering has often been a manual process that is considered time-consuming, tedious and error-prone. To address this limitation, a number of solutions have recently been proposed to allow for automatic protocol reverse engineering. Unfortunately, they are either limited in extracting protocol fields due to lack of program semantics in network traces or primitive in only revealing the flat structure of protocol format. In this paper, we present a system called AutoFormat that aims at not only extracting protocol fields with high accuracy, but also revealing the inherently “non-flat”, hierarchical structures of protocol messages. AutoFormat is based on the key insight that different protocol fields in the same message are typically handled in different execution contexts (e.g., the runtime call stack). As such, by monitoring the program execution, we can collect the execution context information for every message byte (annotated with its offset in the entire...
Zhiqiang Lin, Xuxian Jiang, Dongyan Xu, Xiangyu Zh
Added 01 Jun 2010
Updated 01 Jun 2010
Type Conference
Year 2008
Where NDSS
Authors Zhiqiang Lin, Xuxian Jiang, Dongyan Xu, Xiangyu Zhang
Comments (0)
books