POSTER: Packet Field Tree: a hybrid approach, open database and evaluation methodology for Automated Protocol Reverse-Engineering

Protocol specifications are useful knowledge for performing penetration testing and building intrusion-detection systems for bespoke networks. However, protocol specifications are typically verbose documents, and when new protocols are tested, considerable manual effort is required to translate these specifications into digital models of expected protocol communication. Automated protocol reverse-engineering (APRE) is a precursor to generating such digital models, and attempts to do so without any access to documentation. We introduce Packet Field Tree (PFT), the first hybrid approach combining the advantages of heuristic and supervised-learning methods. We apply it to one aspect of the APRE problem, that of discerning the boundaries between packet fields, and it does so with a superior mean perfection, an APRE-specific quasi-accuracy measure, of 0.27 over a variety of 21 protocols. This is an improvement of 0.11 compared to the next best APRE method. PFT also classifies the syntax of every discerned field - an output unique to our method. We make the PFT and our benchmark dataset of 21 protocols available, with both designed to ease integration of community contributions. Our further work aims to establish a human-preferenced mechanism to determine which APRE models are favoured by security practitioners, and which measures accurately reflect human preference.