Sciweavers

Share
IMC
2006
ACM

binpac: a yacc for writing application protocol parsers

9 years 7 months ago
binpac: a yacc for writing application protocol parsers
A key step in the semantic analysis of network traffic is to parse the traffic stream according to the high-level protocols it contains. This process transforms raw bytes into structured, typed, and semantically meaningful data fields that provide a high-level representation of the traffic. However, constructing protocol parsers by hand is a tedious and error-prone affair due to the complexity and sheer number of application protocols. This paper presents binpac, a declarative language and compiler designed to simplify the task of constructing robust and efficient semantic analyzers for complex network protocols. We discuss the design of the binpac language and a range of issues in generating efficient parsers from high-level specifications. We have used binpac to build several protocol parsers for the “Bro” network intrusion detection system, replacing some of its existing analyzers (handcrafted in C++), and supplementing its operation with analyzers for new protocols. We ...
Ruoming Pang, Vern Paxson, Robin Sommer, Larry L.
Added 13 Jun 2010
Updated 13 Jun 2010
Type Conference
Year 2006
Where IMC
Authors Ruoming Pang, Vern Paxson, Robin Sommer, Larry L. Peterson
Comments (0)
books