Abstract:

In order to get the format of unknown protocols, a length semantic constraints based packet format mining method is proposed based on length semantic constraints. First, multiple sequence alignment method is applied to partition a packet into segments. Then, a length identification algorithm is utilized to scan the segments separately to infer length fields and corresponding referred field(s). At last, the format (hierarchy structure) of the packets is obtained. Experiments demonstrate the effectiveness of this method: the false negative rates of length fields for GetNextRequest and GetResponse of simple network management protocol version 1 are both 9.1%, and the false positive rates are 16.7% and 23.1%. The packet hierarchy is also obtained, approximately consistent with protocol format specification.

Key words: length field, packet format, protocol specification mining, protocol reverse engineering, multiple sequence alignment