Abstract
The state machine of binary protocol can effectively reflect the behavior characteristics of the protocol, and its inference results are often not highly influenced by the protocol format information and logical interaction. To solve this problem, a protocol message type recognition and protocol state architecture method based on recurrent neural network is proposed. Based on the previous work of format classification, this paper uses recursive neural network to get the state features of protocol messages, and then uses clustering algorithm to mark protocol message types. Finally, the protocol state machine is constructed and optimized. Experimental results on MQTT and RFID data sets show that the proposed method has high precision of protocol state machine inference.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
CNCERT: China Internet Network Security Report 2020. Posts and Telecommunications Press, Beijing (2021)
Weiming, L., Aifang, Z., Jiancai, L., et al.: An automatic network protocol fuzz testing and vulnerability discovering method. Chin. J. Comput. 34(02), 242–255 (2011)
Lingyun, Y., Yi, Y., Dengguo, F., et al.: Syntax and behavior semantics analysis of network protocol of malware. J. Softw. 22(07), 1676–1689 (2011)
Lifa, W., Chen, W., Zheng, H., et al.: Overview on protocol state machine inference: a survey. Appl. Res. Comput. 32(07), 1931–1936 (2015)
Shevertalov, M., Mancoridis, S.: A reverse engineering tool for extracting protocols of networked applications, pp. 229–238. IEEE (2007)
Trifilo, A., Burschka, S., Biersack, E.: Traffic to protocol reverse engineering, pp. 1–8. IEEE (2009)
Chen, W., Lifa, W., Zheng, H., et al.: Method of protocol state machine inference based on state merging. J. PLA Univ. Sci. Technol. (Nat. Science Edition) 16(04), 322–329 (2015)
Jun, W.: EDSM-based protocol state machine reverse for binary protocol. Harbin Institute of Technology (2016)
Comparetti, P.M., et al. Prospex: protocol specification extraction. In: 2009 30th IEEE Symposium on Security and Privacy (2009)
Yan, X.: Research and implementation on the key technologies for binary private protocol reverse. Information Engineering University (2018)
Wang, Y., Zhang, Z., Yao, D., Qu, B., Guo, L.: Inferring protocol state machine from network traces: a probabilistic approach. In: Lopez, J., Tsudik, G. (eds.) ACNS 2011, pp. 1–18. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-21554-4_1
Qin Zhongyuan, L., Kai, Z.Q., et al.: Approach of field format extraction in binary private protocol. J. Chin. Comput. Syst. 40(11), 2318–2323 (2019)
Guorui, W.: Time series data clustering algorithm based on recurrent neural network and its parallelization. Harbin Institute of Technology (2016)
Zeng, X.: Traffic anomaly detection method based on improved RNN and density clustering. Beijing University of Posts and Telecommunications (2019)
Tian Xianzhong, G., Anna, S.H.: Recurrent neural networks for time series with fuzzy control. J. Chin. Comput. Syst. 42(02), 241–245 (2021)
Gu Chunxiang, W., Weisen, S.Y., et al.: Method of unknown protocol classification based on autoencoder. J. Commun. 41(06), 88–97 (2020)
Acknowledgement
The subject is sponsored by the National Natural Science Foundation of P. R. China (No. 61872196, No. 61872194, No. 61902196, No. 62102194 and No. 62102196), Scientific and Technological Support Project of Jiangsu Province (No. BE2019740, No. BK20200753 and No. 20KJB520001), Major Natural Science Research Projects in Colleges and Universities of Jiangsu Province (No. 18KJA520008), Six Talent Peaks Project of Jiangsu Province (No. RJFW-111), Postgraduate Research and Practice Innovation Program of Jiangsu Province (No. KYCX19_0909, No. KYCX19_0911, No. KYCX20_0759, No. KYCX21_0787, No. KYCX21_0788 and No. KYCX21_0799).
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2022 Springer Nature Singapore Pte Ltd.
About this paper
Cite this paper
Chen, Y., Li, P., Zhang, Y., Fang, W. (2022). State Machine Inference Method of Unknown Binary Protocol Based on Recurrent Neural Network. In: Tian, Y., Ma, T., Khan, M.K., Sheng, V.S., Pan, Z. (eds) Big Data and Security. ICBDS 2021. Communications in Computer and Information Science, vol 1563. Springer, Singapore. https://doi.org/10.1007/978-981-19-0852-1_48
Download citation
DOI: https://doi.org/10.1007/978-981-19-0852-1_48
Published:
Publisher Name: Springer, Singapore
Print ISBN: 978-981-19-0851-4
Online ISBN: 978-981-19-0852-1
eBook Packages: Computer ScienceComputer Science (R0)