Show simple item record

AuthorKleber, Stephandc.contributor.author
AuthorHeijden, Rens Wouter van derdc.contributor.author
AuthorKargl, Frankdc.contributor.author
Date of accession2020-02-07T09:50:33Zdc.date.accessioned
Available in OPARU since2020-02-07T09:50:33Zdc.date.available
Date of first publication2020-02-07dc.date.issued
AbstractProtocol reverse engineering based on traffic traces infers the behavior of unknown network protocols by analyzing observable network messages. To perform correct deduction of message semantics or behavior analysis, accurate message type identification is an essential first step. However, identifying message types is particularly difficult for binary protocols, whose structural features are hidden in their densely packed data representation. In this paper, we leverage the intrinsic structural features of binary protocols and propose an accurate method for discriminating message types. Our approach uses a continuous similarity measure by comparing feature vectors where vector elements correspond to the fields in a message, rather than discrete byte values. This enables a better recognition of structural patterns, which remain hidden when only exact value matches are considered. We combine Hirschberg alignment with DBSCAN as cluster algorithm to yield a novel inference mechanism. By applying novel autoconfiguration schemes, we do not require manually configured parameters for the analysis of an unknown protocol, as required by earlier approaches. Results of our evaluations show that our approach has considerable advantages in message type identification result quality but also execution performance over previous approaches.dc.description.abstract
Languageen_USdc.language.iso
PublisherUniversität Ulmdc.publisher
LicenseStandard (ohne Print-on-Demand)dc.rights
Link to license texthttps://oparu.uni-ulm.de/xmlui/license_opod_v1dc.rights.uri
Keywordnetwork reconnaissancedc.subject
Keywordprotocol reverse engineeringdc.subject
Keywordvulnerability researchdc.subject
Dewey Decimal GroupDDC 004 / Data processing & computer sciencedc.subject.ddc
LCSHData transmission systemsdc.subject.lcsh
LCSHReversible computingdc.subject.lcsh
LCSHComputer networksdc.subject.lcsh
LCSHTesting; Data processingdc.subject.lcsh
LCSHComputer network protocolsdc.subject.lcsh
TitleMessage type identification of binary network protocols using continuous segment similaritydc.title
Resource typeBeitrag zu einer Konferenzdc.type
VersionacceptedVersiondc.description.version
DOIhttp://dx.doi.org/10.18725/OPARU-25231dc.identifier.doi
URNhttp://nbn-resolving.de/urn:nbn:de:bsz:289-oparu-25294-6dc.identifier.urn
GNDNetzwerkdc.subject.gnd
GNDComputersicherheitdc.subject.gnd
GNDEvaluationdc.subject.gnd
GNDKommunikationsprotokolldc.subject.gnd
FacultyFakultät für Ingenieurwissenschaften, Informatik und Psychologieuulm.affiliationGeneral
InstitutionInstitut für Verteilte Systemeuulm.affiliationSpecific
Peer reviewjauulm.peerReview
DCMI TypeTextuulm.typeDCMI
CategoryPublikationenuulm.category
Quellenangabe - HerausgeberInstitute of Electrical and Electronics Engineerssource.contributor.editor1
Source - Place of publicationInstitute of Electrical and Electronics Engineerssource.publisher
Source - Volume2020source.volume
Conference nameIEEE International Conference on Computer Communications (INFOCOM)uulm.conferenceName
Conference placeBeijinguulm.conferencePlace
Conference start date2020uulm.conferenceStartDate
Open AccessGreen Publisheduulm.OA
WoS000620945800227uulm.identifier.wos
Bibliographyuulmuulm.bibliographie


Files in this item

Thumbnail

This item appears in the following Collection(s)

Show simple item record