Ipfra: An Online Protocol Reverse Analysis Mechanism

Protocol reverse engineering is of great significance for discovering protocol vulnerabilities, improving protocol security and reusing protocol. The existing protocol reverse analysis methods usually need a great deal of computation and often takes a long time, which seriously affects the effect of real-time analysis. This paper proposes an incremental protocol format extraction algorithm, which divides the network traffic into different substreams, and introduces error decision mechanism to avoid local errors caused by partition, so as to ensure the correctness. By dynamic evaluation of the complexity of the protocol analysis, the incremental protocol analysis method can effectively improve the efficiency of the protocol reverse engineering.