Protocol reverse engineering is crucial in the face of numerous unknown protocols on the Internet. However, conventional protocol reverse engineering relies heavily on manual analysis, which is both inefficient and time-consuming. This paper proposes ArchInfer, a novel approach to infer the message field types of protocol terminal programs based on execution traces. We first introduce the concepts of logical locations and logical variables, and propose classification criteria for machine instructions. On this basis, we present the ArchInfer algorithm, which performs different operations based on instruction types to infer the types of logical variables. Experimental results using open-source terminal programs demonstrate that ArchInfer outperforms existing methods in both the accuracy and completeness of inferred message field types.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

ArchInfer: An Automatic Protocol Format Inference Algorithm Based on Dynamic Program Analysis

  • Kehan Wang,
  • Fanghui Sun,
  • Tingyue Yu,
  • Zihong Chen,
  • Zhengze Wu,
  • Shen Wang

摘要

Protocol reverse engineering is crucial in the face of numerous unknown protocols on the Internet. However, conventional protocol reverse engineering relies heavily on manual analysis, which is both inefficient and time-consuming. This paper proposes ArchInfer, a novel approach to infer the message field types of protocol terminal programs based on execution traces. We first introduce the concepts of logical locations and logical variables, and propose classification criteria for machine instructions. On this basis, we present the ArchInfer algorithm, which performs different operations based on instruction types to infer the types of logical variables. Experimental results using open-source terminal programs demonstrate that ArchInfer outperforms existing methods in both the accuracy and completeness of inferred message field types.