TY - GEN
T1 - Automatic Field Extraction of Extended TLV for Binary Protocol Reverse Engineering
AU - Huang, Zewen
AU - Wu, Kui
AU - Huang, Shengqiang
AU - Zhou, Yang
AU - Giagone, Ronnie Salvador
PY - 2022
Y1 - 2022
N2 - Type Length Value (TLV) is one of the main structures commonly used in network protocols. A large number of proprietary protocols, whose specification is unknown to the public, run in the current Internet as well as domain-specific Internet of Things (IoT) applications. It is critical to infer the TLV fields within a packet because this information can help network administrators quickly identify abnormal traffic and potential attacks. Inferring TLV fields belongs to the general task of protocol reverse engineering and is particularly challenging for binary protocols, where the boundaries of TLV fields have many possible positions. Existing methods for reverse engineering binary protocols involve many parameters and only work for protocols strictly following the conventional TLV format. We extend the concept of TLV to accommodate a broader category of structural patterns in various binary protocols, such as TCP, IP, ModBus, and MQTT. We then design algorithms to automatically extract the extended - TLV fields from packets. Via a series of experiments over several protocols, we demonstrate that our algorithms can accurately and quickly identify the extended-TLV fields in all the tested protocols. Our approach can thus be deployed as a general method for automatically reverse engineering binary protocol format. © 2022 IEEE.
AB - Type Length Value (TLV) is one of the main structures commonly used in network protocols. A large number of proprietary protocols, whose specification is unknown to the public, run in the current Internet as well as domain-specific Internet of Things (IoT) applications. It is critical to infer the TLV fields within a packet because this information can help network administrators quickly identify abnormal traffic and potential attacks. Inferring TLV fields belongs to the general task of protocol reverse engineering and is particularly challenging for binary protocols, where the boundaries of TLV fields have many possible positions. Existing methods for reverse engineering binary protocols involve many parameters and only work for protocols strictly following the conventional TLV format. We extend the concept of TLV to accommodate a broader category of structural patterns in various binary protocols, such as TCP, IP, ModBus, and MQTT. We then design algorithms to automatically extract the extended - TLV fields from packets. Via a series of experiments over several protocols, we demonstrate that our algorithms can accurately and quickly identify the extended-TLV fields in all the tested protocols. Our approach can thus be deployed as a general method for automatically reverse engineering binary protocol format. © 2022 IEEE.
KW - Binary Protocol Reverse Engineering
KW - Extended TLV
UR - https://www.scopus.com/pages/publications/85138339811
UR - https://www.scopus.com/record/pubmetrics.uri?eid=2-s2.0-85138339811&origin=recordpage
U2 - 10.1109/ICCCN54977.2022.9868903
DO - 10.1109/ICCCN54977.2022.9868903
M3 - RGC 32 - Refereed conference paper (with host publication)
SN - 978-1-6654-9727-5
T3 - Proceedings - International Conference on Computer Communications and Networks, ICCCN
BT - ICCCN 2022 - The 31st International Conference on Computer Communications and Networks
PB - IEEE
T2 - 31st International Conference on Computer Communications and Networks (ICCCN 2022)
Y2 - 25 July 2022 through 27 July 2022
ER -