Binpac: A yacc for writing application protocol parsers

Proceedings of the ACM SIGCOMM Internet Measurement Conference, IMC

Volumn , Issue , 2006, Pages 289-300

  Pang, Ruoming ^a   Paxson, Vern ^b   Sommer, Robin ^c   Peterson, Larry ^d  

^a GOOGLE INC   (United States)

^b LAWRENCE BERKELEY NATIONAL LABORATORY   (United States)

^c INTERNATIONAL COMPUTER SCIENCE INSTITUTE   (United States)

^d PRINCETON UNIVERSITY   (United States)

Author keywords

Parser generator; Protocol

Indexed keywords

COMPUTATIONAL COMPLEXITY; HIGH LEVEL LANGUAGES; NETWORK PROTOCOLS; SEMANTICS; SPECIFICATIONS; TELECOMMUNICATION TRAFFIC;

COMPLEX NETWORK PROTOCOLS; NETWORK TRAFFIC; PARSER GENERATORS; SEMANTIC ANALYSIS;

AUTOMATA THEORY;

EID: 34547396634     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1177080.1177119     Document Type: Conference Paper

References (46)

1. M. B. Abbott and L. L. Peterson. A language-based approach to protocol implementation. IEEE/ACM Transactions on Networking, 1(1):4-19, 1993.
2. M. Arlitt, B. Krishnamurthy, and J. C. Mogul. Predicting short-transfer latency from TCP arcana: A trace-based validation. In Proceedings of the Internet Measurement Conference (IMC), October 2005.
3. Abstract Syntax Notation One (ASN.1). ISO/IEC 8824-1:2002.
4. G. Back. Datascript - a specification and scripting language for binary data. In GPCE '02: The ACM SIGPLAN/SIGSOFT Conference on Generative Programming and Component Engineering, pages 66-77, London, UK, 2002. Springer-Verlag.
5. E. Biagioni, R. Harper, and P. Lee. A network protocol stack in Standard ML. Higher-Order and Symbolic Computation, 14(4):309-356, 2001.
6. T. P. Blumer and J. C. Burruss. Generating a service specification of a connection management protocol. In PSTV, pages 161-170, 1982.
7. N. Borisov, D. J. Brumley, H. J. Wang, J. Dunagan, P. Joshi, and C. Guo. Generic application-level protocol analyzer and its language. Under submission.
8. Common Internet File System. http://www.snia.org/ tech_activities/CIFS/ CIFS-TR-1p00_FINAL.pdf.
9. D. Crocker. RFC 2234: Augmented BNF for Syntax Specifications: ABNF.
10. DCE 1.1: Remote procedure call. http://www.opengroup.org/onlinepubs/ 9629399/toc.htm.
11. DSniff. www.monkey.org/dugsong/dsniff.
12. The Ethereal Network Analyzer, http://www.ethereal.com/.
13. A. Feldmann, N. Kammenhuber, O. Maennel, B. Maggs, R. D. Prisco, and R. Sundaram. A Methodology for Estimating Interdomain Web Traffic Demand. In Proceedings of the Internet Measurement Conference (IMC), October 2004.
14. R. Fielding, J. Gettys, J. Mogul, H. Frystyk, L. Masinter, P. Leach, and T. Berners-Lee. RFC 2616: Hypertext Transfer Protocol - HTTP/1.1, June 1999.
15. K. Fisher and R. Gruber. PADS: A domain-specific language for processing ad hoc data. In Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI), pages 295-304, New York, NY, USA, 2005. ACM Press.
16. K. Fisher, Y. Mandelbaum, and D. Walker. The next 700 data description languages. In Proceedings of the 24th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (POPL), pages 2-15, New York, NY, USA, 2006. ACM Press.
17. M. Handley, C. Kreibich, and V. Paxson. Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics. In Proceedings of USENIX Security Symposium, 2001.
18. G. J. Holzmann. The model checker SPIN. IEEE Trans. Softw. Eng., 23(5):279-295, 1997.
19. V. Jacobson, C. Leres, and S. McCanne. TCPDUMP. ftp://ftp.ee.lbl.gov/libpcap.tar.Z.
20. S. C. Johnson. YACC - Yet Another Compiler-Compiler. Computer Science Technical Report No. 32, Bell Laboratories, Murray Hill, New Jersey, July 1975.
21. J. Jung and E. Sit. An Empirical Study of Spam Traffic and the Use of DNS Black Lists. In Proceedings of the Internet Measurement Conference (IMC), Taormina, Italy, October 2004.
22. E. Kohler, M. F. Kaashoek, and D. R. Montgomery. A readable TCP in the Prolac protocol language. In Proceedings of the ACM SIGCOMM Conference, pages 3-13, Cambridge, MA, August 1999.
23. C. Kreibich. NetDude (NETwork DUmp data Displayer and Editor). http://netdude.sourceforge.net/.
24. C. Kreibich. Design and implementation of netdude, a framework for packet trace manipulation. June 2004.
25. A. Kumar, V. Paxson, and N. Weaver. Exploiting Underlying Structure for Detailed Reconstruction of an Internet-scale Event. In Proceedings of the Internet Measurement Conference (IMC), October 2005.
26. P. J. McCann and S. Chandra. Packet Types: Abstract specifications of network protocol messages. In Proceedings of the ACM SIGCOMM Conference, pages 321-333, 2000.
27. P. Mockapetris. DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION, Section 4.1.4, November 1987. RFC 1035.
28. NFR Security. http://www.nfr.com.
29. R. Pang, V. Yegneswaran, P. Barford, V. Paxson, and L. Peterson. Characteristics of Internet Background Radiation. In Proceedings of the Internet Measurement Conference (IMC), October 2004.
30. T. Parr and R. Quong. ANTLR: A predicated-ll (k) parser generator. Software, Practice and Experience, 25, July 1995.
31. V. Paxson. BRO: A system for detecting network intruders in real time. In Proceedings of USENIX Security Symposium, San Antonio, TX, January 1998.
32. V. Paxson, K. Asanovic, S. Dharmapurikar, J. Lockwood, R. Pang, R. Sommer, and N. Weaver. Rethinking hardware support for network analysis and intrusion prevention. In Proceedings of Workshop on Hot Topics in Security (HotSec), Vancouver, B.C., Canada, July 2006.
33. NetWare Core Protocol. http://forge.novell.com/modules/xfmod/ project/?ncp.
34. T. H. Ptacek and T. N. Newsham. Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection. Technical report, Secure Networks, Inc., January 1998.
35. M. Roesch. SNORT: Lightweight intrusion detection for networks. In Proceedings of USENIX LISA, 1999.
36. The SNORT network intrusion detection system. http://www.snort.org.
37. S. Saroiu, K. P. Gummadi, R. J. Dunn, S. D. Gribble, and H. M. Levy. An analysis of internet content delivery systems. In Proceedings of the Fifth Symposium on Operating Systems Design and Implementation (OSDI), December 2002.
38. C. Shannon and D. Moore. The Spread of the Witty Worm. http://www.caida.org/analysis/security/witty, 2004.
39. R. Srinivasan. RFC 1831: RPC: Remote Procedure Call Protocol Specification.
40. R. Srinivasan. RFC 1832: XDR: External Data Representation Standard.
41. Ethereal OSPF Protocol Dissector Buffer Overflow Vulnerability, http://www.idefense.com/intelligence/ vulnerabilities/display.php?id=349.
42. Snort TCP Stream Reassembly Integer Overflow Exploit. http://www.securiteam.com/exploits/5BP0O209PS.html.
43. Symantec Multiple Firewall NBNS Response Processing Stack Overflow. http://www.eeye.com/html/research/ advisories/AD20040512A.html.
44. tcpdump ISAKMP packet delete payload buffer overflow. http://xforce.iss.net/xforce/xfdb/15680.
45. Separation of concerns. http://en.wikipedia.org/wiki/ Separation_of_concerns.
46. C. Wong, S. Bielski, J. M. McCune, and C. Wang. A study of mass-mailing worms. In Proceedings of the 2005 ACM Workshop on Rapid Malcode (WORM), pages 1-10, New York, NY, USA, 2004. ACM Press.