Inferring protocol state machine from network traces: A probabilistic approach

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 6715 LNCS, Issue , 2011, Pages 1-18

  Wang, Yipeng ^a,c   Zhang, Zhibin ^a   Yao, Danfeng Daphne ^b   Qu, Buyun ^a,c   Guo, Li ^a  

^a INSTITUTE OF COMPUTING TECHNOLOGY   (China)

^b State University   (United States)

^c UNIVERSITY OF CHINESE ACADEMY OF SCIENCES   (China)

Author keywords

Network Security; Probabilistic Protocol State Machine; Protocol Model Inference and Analysis

Indexed keywords

APPLICATION-LEVEL PROTOCOL; INTRUSION PREVENTION; MALICIOUS CODES; MANUAL OPERATIONS; NETWORK SECURITY MANAGEMENT; NEW MODEL; PRIOR KNOWLEDGE; PROBABILISTIC APPROACHES; PROBABILISTIC PROTOCOLS; PROTOCOL MESSAGE; PROTOCOL MODEL; PROTOCOL SPECIFICATIONS; REAL-WORLD APPLICATION; REAL-WORLD NETWORKS; STATE MACHINE; TEXT-BASED PROTOCOLS; VERITAS;

CRYPTOGRAPHY; INTRUSION DETECTION; NETWORK MANAGEMENT; NETWORK PROTOCOLS; REVERSE ENGINEERING; SPECIFICATIONS;

NETWORK SECURITY;

EID: 79959319598     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-642-21554-4_1     Document Type: Conference Paper

References (23)

1. Lim, J., Reps, T., Liblit, B.: Extracting Output Formats from Executables. In: WCRE 2006: Proceedings of the 13th Working Conference on Reverse Engineering (2006).
2. Gringoli, F., Salgarelli, L., Dusi, M., Cascarano, N., Risso, F., Claffy, K.C.: GT: picking up the truth from the ground for internet traffic. In: SIGCOMM Comput. Commun. Rev. (2009).
3. Comparetti, P.M., Wondracek, G., Kruegel, C., Kirda, E.: Prospex: Protocol Specification Extraction. In: SP 2009: Proceedings of the 2009 30th IEEE Symposium on Security and Privacy (2009).
4. Leita, C., Mermoud, K., Dacier, M.: Scriptgen: an automated script generation tool for honeyd. In: Annual Computer Security Applications Conference (2005).
5. Caballero, J., Yin, H., Liang, Z., Song, D.: Polyglot: automatic extraction of protocol message format using dynamic binary analysis. In: CCS 2007: Proceedings of the 14th ACM conference on Computer and Communications Security (2007).
6. Cui, W., Kannan, J., Wang, H.J.: Discoverer: automatic protocol reverse engineering from network traces. In: SS 2007: Proceedings of 16th USENIX Security Symposium on USENIX Security Symposium (2007).
7. Haffner, P., Sen, S., Spatscheck, O., Wang, D.: ACAS: automated construction of application signatures. In: MineNet 2005: Proceedings of the 2005 ACM SIGCOMM workshop on Mining network data (2005).
8. Kannan, J., Jung, J., Paxson, V., Koksal, C.E.: Semi-automated discovery of application session structure. In: IMC 2006: Proceedings of the 6th ACM SIGCOMM conference on Internet measurement (2006).
9. Ma, J., Levchenko, K., Kreibich, C., Savage, S., Voelker, G.M.: Unexpected means of protocol inference. In: IMC 2006: Proceedings of the 6th ACM SIGCOMM conference on Internet measurement (2006).
10. Vidal, E., Thollard, F., de la Higuera, C., Casacuberta, F., Carrasco, R.C.: Probabilistic Finite-State Machines-Part I. IEEE Trans. Pattern Anal. Mach. Intell. (2005).
11. Kendall, M.G., Stuart, A., Ord, J.K.: Kendall's advanced theory of statistics. Oxford University Press, Inc., Oxford (1987).
12. Kaufman, L., Rousseeuw, P.: Finding Groups in Data: An Introduction to Cluster Analysis. Wiley, Chichester (1990).
13. Jaccard, P.: The distribution of the flora in the alpine zone. The New Phytologist (1912).
14. Brumley, D., Caballero, J., Liang, Z., Newsome, J., Song, D.: Towards automatic discovery of deviations in binary implementations with applications to error detection and fingerprint generation. In: SS 2007: Proceedings of 16th USENIX Security Symposium on USENIX Security Symposium (2007).
15. Caballero, J., Venkataraman, S., Poosankam, P., Kang, M.G., Song, D., Blum, A.: FiG: Automatic Fingerprint Generation. In: Annual Network and Distributed System Security Symposium (2007).
16. Dreger, H., Feldmann, A., Mai, M., Paxson, V., Sommer, R.: Dynamic applicationlayer protocol analysis for network intrusion detection. In: USENIX-SS 2006: Proceedings of the 15th conference on USENIX Security Symposium (2006).
17. Borisov, N., Brumley, D.J., Wang, H.J.: A Generic Application-Level Protocol Analyzer and its Language. In: Network and Distributed System Security Symposium (2007).
18. Dunn, J.C.: Well separated clusters and optimal fuzzy-partitions. Journal of Cybernetics (1974).
19. Internet2 netflow statistics, http://netflow.internet2.edu.
20. XUNLEI, http://www.xunlei.com/.
21. PPLIVE, http://www.pptv.com/.
22. How SambaWasWritten, http://samba.org/ftp/tridge/misc/french-cafe.txt.
23. Gaim Instant Messaging Client, http://gaim.sourceforge.net/