SegInfer: Binary Network Protocol Segmentation Based on Probabilistic Inference

Protocol Reverse Engineering (PRE) is of great practical importance in Internet security-related fields such as intrusion detection, vulnerability mining, and protocol fuzzing. For unknown binary protocols having fixed-length fields, and the accurate identification of field boundaries has a great impact on the subsequent analysis and final performance. Hence, this paper proposes a new protocol segmentation method based on Information-theoretic statistical analysis for binary protocols by formulating the field segmentation of unsupervised binary protocols as a probabilistic inference problem and modeling its uncertainty. Specifically, we design four related constructions between entropy changes and protocol field segmentation, introduce random variables, and construct joint probability distributions with traffic sample observations. Probabilistic inference is then performed to identify the possible protocol segmentation points. Extensive trials on nine common public and industrial control protocols show that the proposed method yields higher-quality protocol segmentation results.