一句话：提出 ProbePRE，通过自主生成数据包探索协议处理程序，实现多格式协议逆向工程。
协议逆向工程（PRE）旨在推断未知协议的格式。现有基于网络流量或执行轨迹的方法存在两大局限：一是依赖流量数据集的质量与规模，导致准确率低、泛化性差；二是未能充分考虑真实协议普遍存在的多格式特性（即同一协议可能支持多种不同格式）。为此，作者提出 ProbePRE 工具，通过自主生成数据包对协议处理程序进行多格式提取，其三项关键技术为：带隐式数据流分析的执行追踪策略以获取更细粒度的执行信息；针对不同程序结构定制的约束提取方法以通过协议校验；以及创新的约束组合算法以构造有效数据包、驱动处理程序执行多样的解析路径。实验表明，ProbePRE 在字段分割准确率上取得 0.88 的 F1 值，显著优于 4 个现有最优工具；在 6 个协议处理程序上的多格式提取完整度达 83%；基本块覆盖测试中较传统流量数据集方法提升 67%，验证了其路径探索能力。
Protocol reverse engineering (PRE) aims to infer the protocol formats of unknown protocols. Existing techniques, whether Network-Trace based or Execution-Trace based methods, face two main limitations: a reliance on the quality and scale of traffic datasets, which often leads to low accuracy and poor generalization; and a failure to adequately consider the multi-format characteristic prevalent in real-world protocols (i.e., the same protocol may support multiple different formats).To address these challenges, we propose ProbePRE—a PRE tool that performs multi-format extraction on protocol handlers by autonomously generating packets. ProbePRE employs three key techniques: (1) an execution tracing strategy enhanced with implicit data flow analysis to obtain more detailed execution information; (2) constraint extraction methods tailored for different program structures to pass protocol validation; and (3) an innovative constraint combination algorithm to construct effective packets that guide the protocol handler to execute diverse protocol parsing paths. In our experimental evaluation, we compared ProbePRE with 4 state-of-the-art PRE tools in terms of field segmentation accuracy. The results demonstrated that ProbePRE achieved an F1 score of 0.88, significantly outperforming existing methods. Furthermore, evaluations on 6 protocol handlers indicated that ProbePRE attained 83% completeness in multi-format extraction tasks. Notably, in basic block coverage tests, ProbePRE achieved a 67% improvement over traditional traffic dataset methods, which fully validates the effectiveness of its path exploration capabilities.
DOI 原文 ·
@inproceedings{paperbot9272,
title = {Breaking the Traffic Barrier: Unveiling Multi-Format of Protocols via Autonomous Program Exploration},
author = {Dingzhao Xue and Yibo Qu and Bowen Jiang and Xin Chen and Shuaizong Si and Shichao Lv and Zhiqiang Shi and Limin Sun},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00173}
}