Bit‐oriented format extraction approach for automatic binary protocol reverse engineering

Protocol reverse analysis is a research hotspot in the field of information confrontation and network security. Inferring the format of unknown binary protocols from network traces is one challenge task in protocol reverse engineering. In this study, a protocol reverse method for binary protocol which combined with hierarchical clustering and probability alignment is proposed. First, the method classifies the frames with same format into one set based on hierarchical clustering. Second, probability alignment algorithm is adopted to align the corresponding fields in protocol frame accurately. Finally, according to the characteristics of the statistical data, the boundary of the adjacent fields in the protocol is determined, and the protocol format is extracted according to the field boundary. The experimental results show that the method can effectively identify the format specification of the binary protocol and the semantic specification of some fields.

Application-level protocol specifications are helpful for network security management, including intrusion detection and intrusion prevention which rely on monitoring technologies such as deep packet inspection. Moreover, detailed knowledge of protocol specifications is also an effective way of detecting malicious code. However, current methods for obtaining unknown and proprietary protocol message formats (i.e., no publicly available protocol specification), especially binary protocols, highly rely on manual operations, such as reverse engineering which is time-consuming and laborious. In this paper, we propose Biprominer, a tool that can automatically extract binary protocol message formats of an application from its real-world network trace. In addition, we present a transition probability model for a better description of the protocol. The chief feature of Biprominer is that it does not need to have any priori knowledge of protocol formats, because Biprominer is based on the statistical nature of the protocol format. We evaluate the efficacy of Biprominer over three binary protocols, with an average precision more than 99% and a recall better than 96.7%.

In this study we empirically investigate the adaptation of Test-Driven Development (TDD) practice into software Reverse Engineering (RE) process. We call this adaptation as Test-Driven Reverse Engineering (TDRE) process. We propose a two-layer prioritization process, which firstly prioritizes the already-implemented functionalities using the Cumulative Voting (CV) method and three prioritization criteria (importance, complexity and dependency), and secondly prioritizes test-cases for each prioritized functionality, using the same criteria. We conducted a case study in academia with students to empirically evaluate the usability and effectiveness of the prioritization process and the TDD adaptation into RE process. The results have shown that students with a good performance in testing had also good performance in designing UML class-diagrams. Moreover, the implementation of hierarchical test-cases for the already prioritized functionalities, improves code comprehension and redesigning in the RE process in terms of better total grades obtained.

Unsupervised field segmentation of unknown protocol messages

Protocol reverse engineering (PRE) aims to infer the specification of network protocols when the source code is not available. Specifically, field inference is one crucial step in PRE to infer the field formats and semantics. To perform field inference, binary analysis based PRE techniques are one major approach category. However, such techniques face two key challenges --- (1) the format inference is fragile when the logics of processing input messages may vary among different protocol implementations, and (2) the semantic inference is limited by inadequate and inaccurate inference rules.

Protocol Reverse Engineering (PRE) is of great significance to the research of cyber security and it is helpful to understand protocol specifications. There has been many researches on PRE but most of them need additional manual analysis, which is not available for private and unknown protocols. We propose a protocol state analysis and annotation method, which extracts the feature information of binary-based protocol data through an auto-encoder model. Moreover, density-based clustering algorithm is only used to distinguish protocol types in existing studies, we propose an improved algorithm and apply it to protocol state analysis. Finally, we apply alignment algorithm to get state information and do annotation. We run simulation to verify the effectiveness of proposed method and prove its feasibility in private and unknown protocols. The results of clustering algorithms are compared to show the improvement. Then the application of proposed method is summarized based on the simulation results, which provides a novel idea for the protocol analysis.

Software patterns are often considered as an important methodology in the process of analysis and design of a software, when the proposed architecture of the software is a complex one. During the process of reverse engineering, design patterns become helpful to analyze the source code. A pattern-based analysis often improves maintainability of the source code. The proposed reverse engineering approach considers software metrics for the development of the datasets. The study is comprises of two phases such as preparation of requisite dataset based on object-oriented software metrics and identification of design patterns. Preparation of dataset is carried out using pattern instances from source code, mapped with software metrics. Analysis of design patterns is accomplished by considering a learning-based method i.e., Artificial Neural Network. In this study, two open source software such as JRefactory and Quaqua have been considered to exploit the idea of reverse engineering.

Comprehending and modeling the behavior of user interfaces exposed by Rich Internet Applications (RIAs) are important activities in software maintenance, testing, and evolution. This paper presents an ‘agile’ process for the reverse engineering of Rich Internet Application User Interfaces: the process is based on dynamic analysis of the application, is iterative and exploits heuristic clustering criteria for reducing the data gathered by dynamic analysis. Moreover, it is based on the continuous validation feedback of the process executor, and allows the incremental reconstruction of a Finite State Machine for modeling the behavior of RIA GUIs. This approach is supported by CReRIA, an integrated reverse engineering environment that provides automatic facilities for executing the process and incrementally recovering the FSM model. A preliminary experiment involving the analysis of three real Web applications showed the feasibility of the approach, and highlighted interesting advantages of using the agility in reverse engineering processes.

The reverse engineering process in development is widely used to carry out the reverse engineering process for the design of certain products, in this study the reverse engineering process on the palm oil lorry wheel is to improve the design as well as a combination of materials to increase the life of the lorry wheel product in the palm oil processing. The process of scanning the surface of the lorry wheel using camera and the reverse engineering process is carried out by measuring the precision of the lorry wheel by measuring using a precision measuring instrument, data obtained by measurement and reconstruction model. data obtained by measurement and reconstruction model using CAD software and CAE software used to analyze the CAD and CAE software are used to analyze the design results after the reverse engineering process. reverse engineering process. So, it is necessary to develop a reverse engineering system design that will be useful in terms of efficiency and service life of the lorry wheel, in the design of this lorry wheel uses CAD and CAM software to model the lorry wheels with simulation and analysis systems. The next process is to modify and remanufacture the lorry wheel model using machine tools so that the prototype of the manufacturing process can be tested. so that the prototype of the manufacturing process can be tested on the lorry to see the durability of the reverse engineering product. to see the durability of the reverse engineering product. The results of this research showed that the reverse engineering data can be interpolated for further CAE process

Relational reasoning-based approach for network protocol reverse engineering

ICSMFT5: Multi-Feature Fusion Large Model Approach for Industrial Control Protocol Reverse Engineering

Reengineering of user interfaces (RUI) integrates useful, old technologies and modern concepts of UI design. In particular, RUI can be applied for the migration of business relevant database applications on host systems. Their life-cycle can be extended by distributing presentation and dialogue functionality to an intelligent front-end. Operationally, direct benefits can be realised by increasing the user's productivity. Strategically, RUI can trigger the stepwise migration of old software systems. RUI-strategies minimise migrational risk and can be flexibly applied where user acceptance is minimal or the economical benefits are maximal. However, the realisation of a successful RUI-project requires complex knowledge in a broad range of subjects. This knowledge has to be covered by a generic process model. Our goal is to present an integral approach that involves an extensive preliminary analysis, a reverse engineering process and a forward engineering process. This concept — currently developed with Ploenzke, Inc. — can be generically applied for dialogue solutions differing in complexity.

With the advancement of technology it is now possible to have a reconstructed or reengineered product arising out of any damaged product or part by any digitisation techniques. The reengineered or reconstructed products may prove to be an economically viable option for manufacturing industries especially where higher costs are associated with products like turbine rotors, boiler components, auto components, etc. Also, in many cases, this technique bridges the gap between the actual products and their lost or damaged design data. In the present work, an integrated reverse engineering and rapid prototyping approach has been demonstrated for the reconstruction and subsequent finite element analysis of a damaged impeller. Further, the optimisation of the parameters is carried out for the reconstructed impeller. The results obtained for the reconstructed impeller are compared with that of the original rotor and the finding are discussed in light of some previous works conducted.

Our rapid prototype of damaged systems project seeks to provide a technology for allowing engineers to build demonstration prototypes of damaged products from analysis post-processing data. Most commercial finite element programs do not have a capability to construct deformed geometry at the conclusion of an analysis simulation. It is therefore not presently possible to build prototypes of predicted states of a product as the result of being subjected to simulated adverse environments. Our approach is to reverse engineer a description of a deformed finite element mesh into a stereolithography format for prototyping using a Selective Laser Sintering (SLS) machine. This stereolithography file can be generated from deformed surface node information as well as from a reconstructed surface defined by inspection data. We are developing software to allow users to represent a part or assembly in a deformed condition. The damaged part can then be manufactured using the SLS process for visualization and assessment purposes. The resulting representation can also be used to create simulated X-rays of a damaged or deformed configuration for comparison with experimental test results or field data. This allows engineers to benchmark their analysis methods and provide increased understanding of analysis results through enhanced visualization. The process of reverse engineering `in-use` or damaged products allows for a more refined inspection and comparison of imperfect parts. It addresses the issue of whether or not a part will still work when subjected to certain environments or scenarios. Answers to this question can be found using our model reconstruction technique that represents an `as- built` engineering model configuration. An additional feature of this reverse engineering process is product benchmarking and closer engineer/manufacturer interactions.

BackgroundMyotonic dystrophy type 1 (DM1) is an incurable multisystem disease caused by a CTG-repeat expansion in the DM1 protein kinase (DMPK) gene. The OPTIMISTIC clinical trial demonstrated positive and heterogenous effects of cognitive behavioral therapy (CBT) on the capacity for activity and social participations in DM1 patients. Through a process of reverse engineering, this study aims to identify druggable molecular biomarkers associated with the clinical improvement in the OPTIMISTIC cohort.MethodsBased on full blood samples collected during OPTIMISTIC, we performed paired mRNA sequencing for 27 patients before and after the CBT intervention. Linear mixed effect models were used to identify biomarkers associated with the disease-causing CTG expansion and the mean clinical improvement across all clinical outcome measures.ResultsWe identified 608 genes for which their expression was significantly associated with the CTG-repeat expansion, as well as 1176 genes significantly associated with the average clinical response towards the intervention. Remarkably, all 97 genes associated with both returned to more normal levels in patients who benefited the most from CBT. This main finding has been replicated based on an external dataset of mRNA data of DM1 patients and controls, singling these genes out as candidate biomarkers for therapy response. Among these candidate genes were DNAJB12, HDAC5, and TRIM8, each belonging to a protein family that is being studied in the context of neurological disorders or muscular dystrophies. Across the different gene sets, gene pathway enrichment analysis revealed disease-relevant impaired signaling in, among others, insulin-, metabolism-, and immune-related pathways. Furthermore, evidence for shared dysregulations with another neuromuscular disease, Duchenne muscular dystrophy, was found, suggesting a partial overlap in blood-based gene dysregulation.ConclusionsDM1-relevant disease signatures can be identified on a molecular level in peripheral blood, opening new avenues for drug discovery and therapy efficacy assessments.