A Review of Protocol Reverse Engineering Based on Network Traffic

Authors:
Open Access
Publisher website
Google Scholar
Abstract
Protocol reverse engineering (PRE) aims to automatically reconstruct the structural specifications and behavioral models of unknown protocols from network traffic without prior knowledge, serving as a critical enabling technology for cybersecurity, protocol testing, intrusion detection, and related fields. This paper provides a systematic review of research on PRE based on network traffic. First, a universal four-stage analytical framework is proposed, encompassing data preprocessing and message clustering, protocol format inference, field semantic inference, and protocol state machine inference. Subsequently, research progress is organized around three core tasks: for protocol format inference, methods based on sequence alignment, probabilistic statistics, frequent item mining, and deep learning are reviewed; for field semantics inference, two technical approaches—heuristic rules and side-information-based methods—are summarized; for protocol state machine inference, three categories of techniques—traditional methods, probabilistic models, and tree-based structures—are categorized. Finally, the paper concludes by summarizing the primary challenges facing current research and outlining future development trends.
Funding Information
  • the Youth Project of Natural Science Foundation of Henan Province (252300420988)

This publication has 41 references indexed in Scilit: