BinPRE: Enhancing Field Inference in Binary Analysis Based Protocol Reverse Engineering

Protocol Reverse Engineering (PRE) is of great significance to the research of cyber security and it is helpful to understand protocol specifications. There has been many researches on PRE but most of them need additional manual analysis, which is not available for private and unknown protocols. We propose a protocol state analysis and annotation method, which extracts the feature information of binary-based protocol data through an auto-encoder model. Moreover, density-based clustering algorithm is only used to distinguish protocol types in existing studies, we propose an improved algorithm and apply it to protocol state analysis. Finally, we apply alignment algorithm to get state information and do annotation. We run simulation to verify the effectiveness of proposed method and prove its feasibility in private and unknown protocols. The results of clustering algorithms are compared to show the improvement. Then the application of proposed method is summarized based on the simulation results, which provides a novel idea for the protocol analysis.

Protocol message format extraction is a principal process of automatic network protocol reverse engineering when target protocol specifications are not available. However, binary protocol reverse engineering has been a new challenge in recent years for approaches that traditionally have dealt with text‐based protocols rather than binary protocols. In this study, the authors propose a novel approach called PRE‐Bin that automatically extracts binary‐type fields of binary protocols based on fine‐grained bits. First, a silhouette coefficient is introduced into the hierarchical clustering to confirm the optimal clustering number of binary frames. Second, a modified multiple sequence alignment algorithm, in which the matching process and back‐tracing rules are redesigned, is also proposed to analyse binary field features. Finally, a Bayes decision model is invoked to describe field features and determine bit‐oriented field boundaries. The maximum a posteriori criterion is leveraged to complete an optimal protocol format estimation of binary field boundaries. The authors implemented a prototype system of PRE‐Bin to infer the specification of binary protocols from actual traffic traces. Experimental results indicate that PRE‐Bin effectively extracts binary fields and outperforms the existing algorithms.

Protocol reverse analysis is a research hotspot in the field of information confrontation and network security. Inferring the format of unknown binary protocols from network traces is one challenge task in protocol reverse engineering. In this study, a protocol reverse method for binary protocol which combined with hierarchical clustering and probability alignment is proposed. First, the method classifies the frames with same format into one set based on hierarchical clustering. Second, probability alignment algorithm is adopted to align the corresponding fields in protocol frame accurately. Finally, according to the characteristics of the statistical data, the boundary of the adjacent fields in the protocol is determined, and the protocol format is extracted according to the field boundary. The experimental results show that the method can effectively identify the format specification of the binary protocol and the semantic specification of some fields.

Implementation of a conservative checklist-based protocol for oxytocin administration: maternal and newborn outcomes

Unsupervised field segmentation of unknown protocol messages

Reverse engineering of agnostic industrial control protocols (ICPs) based on traffic traces is significant for the security analysis of industrial control systems. Field semantics deduction is an essential step in protocol reverse engineering following the discovery of the message field. Most existing methods rely on knowledge-based analysis for specific fields of common protocols, which require too numerous assumptions and lack semantic knowledge about ICPs. In this paper, we propose a new concept, pattern series, and design the first classification framework for inferring the semantic types of unknown ICPs. Specifically, we first present the definition of pattern series and design the field pattern series generation algorithm for building training data, then develop a field semantics classification model to learn and apply semantic features from known protocols to predict semantic types in unknown protocols. Lastly, we implement a probability-maximizing selection algorithm to obtain optimal semantic types. We demonstrate the effectiveness of the proposed method through extensive experiments with five popular ICPs, including their mixed protocols. Evaluations show that our approach significantly outperforms baseline methods in field semantic recognition, achieving ≥90.8% F1-score.

Research on unknown network protocol reverse engineering is of great significance in many network security applications. Currently most of methods are limited in analyzing plain-text protocols, and a few of method can partly analyze the encryption protocol which is powerless for multiple encryption protocol or sectional encryption protocol. This paper proposes a method of encrypted protocol reverse engineering based on dynamic taint analysis. The method uses Pin to record executed instructions, and then conducts off-line analysis of the data dependencies to build two taint propagation graphs on instruction and function level, then recover the decryption process. The decrypted plaintext can be located due to the decryption process feature. And then, the format of protocol can be parsed. Experiments show that the method can accurately locate the decrypted protocol data of the multiple encryption and sectional encryption protocol, and restore the original format.

Protocol reverse engineering is of great significance for discovering protocol vulnerabilities, improving protocol security and reusing protocol. The existing protocol reverse analysis methods usually need a great deal of computation and often takes a long time, which seriously affects the effect of real-time analysis. This paper proposes an incremental protocol format extraction algorithm, which divides the network traffic into different substreams, and introduces error decision mechanism to avoid local errors caused by partition, so as to ensure the correctness. By dynamic evaluation of the complexity of the protocol analysis, the incremental protocol analysis method can effectively improve the efficiency of the protocol reverse engineering.

Designing and implementing secure applications which use contactless communication link is difficult even when secure hardware is used. Many current proximity devices, such as contactless smart cards or near field communication devices, are verified to be highly secure; however, inappropriate protocol implementation may result in the leak of sensitive information, even if the protocol is also secure by itself. In this paper we show a concept of automated vulnerability search in protocol implementation by using verification methods, which should help developers to verify their applications. We also show simple example of possible attack on seemingly secure payment protocol implemented using seemingly secure smart card to show the way the adversary can abuse improper implementation. The vulnerability the attacker exploits can be in one command or in a combination of commands, which are not vulnerable individually. It is not easy to find such combinations manually, this is where the automated verification methods are put to use. A model checker, provided with an appropriate model, can automatically find vulnerabilities which are not likely to be found manually. The model can be created by the actual communication analysis. We wanted to show that the adversary does not have to have the access to the source code of the application to perform a successful attack, so a platform for the application analysis from the actual contactless communication was developed. The platform provides eavesdropping, altering data for man-in-the-middle attack, and emulating of both communication parties. The source code can help the analysis, but would not be sufficient by itself, so creating model from source code was left for future research. When the model checker finds vulnerability, an attack can be executed. The attack can be either successful, revealing real vulnerability which must be fixed, or unsuccessful, which would result in the model refinement and another model checker run.

In this paper we discuss a new application of Semantic Web and Artificial Intelligence in software analysis research. We show on a concrete example - clone detection for object-oriented source code that transitivity closure computation can provide added value to the clone detection community. Our novel approach models the domain of discourse knowledge as a mixture of source code patterns and inheritance trees represented as Directed Acyclic Graphs. Our approach promotes the use of Semantic Web and inference engines in source code analysis. More specifically we take advantage of the Semantic Web and its support for knowledge modeling and transitive closure computation to detect semantic source code clones not detected by traditional detection tools.

Designing and coding security protocols is an error prone task. Several flaws are found in protocol implementations and specifications every year. Formal methods can alleviate this problem by backing implementations with rigorous proofs about their behavior. However, formally-based development typically requires domain specific knowledge available only to few experts and the development of abstract formal models that are far from real implementations. This paper presents a Java-based protocol design and implementation framework, where the user can write a security protocol symbolic model in Java, using a well defined subset of the language that corresponds to applied π -calculus. This Java model can be symbolically executed in the Java debugger, formally verified with ProVerif, and further refined to an interoperable Java implementation of the protocol. Soundness theorems are provided to prove that, under some reasonable assumptions, a simulation relation relates the Java refined implementation to the symbolic model verified by ProVerif, so that, for the usual security properties, a property verified by ProVerif on the symbolic model is preserved in the Java refined implementation. The applicability of the framework is evaluated by developing an extensive case study on the popular SSL protocol.

Existing protocols for high-speed local area networks (HSLANs) and metropolitan area networks (MANs) are dealt with from an implementation standpoint. Emphasis is put on the lowest layers of the ISO OSI (Open Systems Interconnection) Reference Model, i.e. the physical layer and media access control sublayer of the data-link layer. Seven representative state-of-the-art HSLAN and MAN media-access protocols are surveyed and classified, and implementations of these protocols that are used in prototype and commercial networks are analyzed. The complexity, technology, and performance of the implementation are described and compared.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

Impacto en los tiempos puerta-aguja de un conjunto de medidas para optimizar la atención hospitalaria del código ictus

Evaluation of eosinophilia in immigrants in Southern Spain using tailored screening and treatment protocols: A prospective study.

Multicasting has emerged as one of the most focused areas in the field of networking. As the technology and popularity of the Internet grow, applications such as video conferencing that require the multicast feature are becoming more widespread. Another interesting development has been the emergence of dynamically reconfigurable wireless ad hoc networks to interconnect mobile users for applications ranging from disaster recovery to distributed collaborative computing. In this article we describe the on-demand multicast routing protocol for mobile ad hoc networks. ODMRP is a mesh-based, rather than conventional tree-based, multicast scheme and uses a forwarding group concept (only a subset of nodes forwards the multicast packets packets via scoped flooding). It applies on-demand procedures to dynamically build routes and maintain multicast group membership. We also describe our implementation of the protocol in a real laptop testbed.