TIIS (한국인터넷정보학회)
Current Result Document :
| 한글제목(Korean Title) |
Two-Pathway Model for Enhancement of Protocol Reverse Engineering |
| 영문제목(English Title) |
Two-Pathway Model for Enhancement of Protocol Reverse Engineering |
| 저자(Author) |
Young-Hoon Goo
Kyu-Seok Shim
Ui-Jun Baek
Myung-Sup Kim
|
| 원문수록처(Citation) |
VOL 14 NO. 11 PP. 4310 ~ 4330 (2020. 11) |
한글내용
(Korean Abstract) |
|
영문내용
(English Abstract) |
With the continuous emergence of new applications and cyberattacks and their frequent updates, the need for automatic protocol reverse engineering is gaining recognition. Although several methods for automatic protocol reverse engineering have been proposed, each method still faces major limitations in extracting clear specifications and in its universal application. In order to overcome such limitations, we propose an automatic protocol reverse engineering method using a two-pathway model based on a contiguous sequential pattern (CSP) algorithm. By using this model, the method can infer both command-oriented protocols and non-command-oriented protocols clearly and in detail. The proposed method infers all the key elements of the protocol, which are syntax, semantics, and finite state machine (FSM), and extracts clear syntax by defining fine-grained field types and three types of format: field format, message format, and flow format. We evaluated the efficacy of the proposed method over two non-command-oriented protocols and three commandoriented protocols: the former are HTTP and DNS, and the latter are FTP, SMTP, and POP3. The experimental results show that this method can reverse engineer with high coverage and correctness rates, more than 98.5% and 99.1% respectively, and be general for both command-oriented and non-command-oriented protocols.
|
| 키워드(Keyword) |
Protocol reverse engineering
network security
two-pathway model
commandoriented protocols
contiguous sequential pattern algorithm
|
| 파일첨부 |
PDF 다운로드
|
