Reverse Engineering of Network Software Binary Codes for Identification of Syntax and Semantics of Protocol Messages

Q: How can I download an article?

To download an article from SID, first log in to the site, search for the article title, and click on the 'Download Article' option.

Q: How can I download an ISI article?

To download an ISI article on SID, enter the keyword or article title in the search bar, view the relevant results, click on the desired article, and select the 'Download Article' option.

Q: How can I access the SID database?

To access the SID database, visit SID.ir, create an account, and log in to access scientific resources.

Q: Is downloading articles from SID free?

Some articles on SID are available for free, while others require payment. Details are specified on the article's page.

Momenian Nayere; TORK LADANI BEHROUZ

مرکز اطلاعات علمی Scientific Information Database (SID) - Trusted Source for Research and Academic Resources

Journal Paper

Paper Information

Journal: SIGNAL AND DATA PROCESSING Year:2019 | Volume:16 | Issue:2 (40) Page(s): 19-40

Download Full-Text

Persian Verion

View:

627

Download:

Cites:

Information Journal Paper

Title

Reverse Engineering of Network Software Binary Codes for Identification of Syntax and Semantics of Protocol Messages

Author(s)

Momenian Nayere | TORK LADANI BEHROUZ | Issue Writer Certificate

Keywords

Reverse engineeringQ1

Protocol format extractionQ1

Semantic informationQ1

Abstract

Reverse engineering of network applications especially from the security point of view is of high importance and interest. Many network applications use proprietary protocols which specifications are not publicly available. Reverse engineering of such applications could provide us with vital information to understand their embedded unknown protocols. This could facilitate many tasks including deep protocol inspection in next generation firewalls and analysis of suspicious binary codes. The goal of protocol Reverse engineering is to extract the protocol format and the protocol state machine. The protocol format describes the structure of all messages in protocol and the protocol state machine describes the sequence of messages that the protocol accept. Recently, there has been rising interest in automatic protocol Reverse engineering. These works are divided into activities that extract protocol format and activities that extract protocol state machine. They can also be divided into those uses as input network traffic and those uses as input program implements the protocol. However, although there are some researches in this field, they mostly focused on extracting syntactic structure of the protocol messages. In this paper, some new techniques are presented to improve extracting the format (both the syntax and semantics) of protocol messages via Reverse engineering of binary codes of network applications. To do the research, an integration of dynamic and static binary code analysis are used. The field extraction approach first detects length fields and separators and then by applying rules based on compiler principles locates all the fields in the messages. The semantic extraction approach is based on the Semantic information available in the program implements of the protocol and also information exists in the environment of the program. For evaluating the proposed approach, four different network applications including DNS, eDonkey, Modbus, and STUN were analyzed. Experimental results show that the proposed techniques not only could extract more complete syntactic structure of messages than similar works, but also it could extract a set of advantageous Semantic information about the protocol messages that are not achievable in previous works.

Cites

No record.

References

No record.

Cite

APA: Copy

Momenian, Nayere, & TORK LADANI, BEHROUZ. (2019). Reverse Engineering of Network Software Binary Codes for Identification of Syntax and Semantics of Protocol Messages. SIGNAL AND DATA PROCESSING, 16(2 (40) ), 19-40. SID. https://sid.ir/paper/160877/en

Vancouver: Copy

Momenian Nayere, TORK LADANI BEHROUZ. Reverse Engineering of Network Software Binary Codes for Identification of Syntax and Semantics of Protocol Messages. SIGNAL AND DATA PROCESSING[Internet]. 2019;16(2 (40) ):19-40. Available from: https://sid.ir/paper/160877/en

IEEE: Copy

Nayere Momenian, and BEHROUZ TORK LADANI, “Reverse Engineering of Network Software Binary Codes for Identification of Syntax and Semantics of Protocol Messages,” SIGNAL AND DATA PROCESSING, vol. 16, no. 2 (40) , pp. 19–40, 2019, [Online]. Available: https://sid.ir/paper/160877/en

Related Journal Papers