A Type-Aware Approach to Message Clustering for Protocol Reverse Engineering
Protocol Reverse Engineering (PRE) is crucial for information security of Internet-of-Things (IoT), and message clustering determines the effectiveness of PRE. However, the quality of services still lags behind the strict requirement of IoT applications as the results of message clustering are often...
| Published in: | Sensors |
|---|---|
| Main Authors: | , , , |
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2019-02-01
|
| Subjects: | |
| Online Access: | https://www.mdpi.com/1424-8220/19/3/716 |
| _version_ | 1852766126298103808 |
|---|---|
| author | Xin Luo Dan Chen Yongjun Wang Peidai Xie |
| author_facet | Xin Luo Dan Chen Yongjun Wang Peidai Xie |
| author_sort | Xin Luo |
| collection | DOAJ |
| container_title | Sensors |
| description | Protocol Reverse Engineering (PRE) is crucial for information security of Internet-of-Things (IoT), and message clustering determines the effectiveness of PRE. However, the quality of services still lags behind the strict requirement of IoT applications as the results of message clustering are often coarse-grained with the intrinsic type information hidden in messages largely ignored. Aiming at this problem, this study proposes a type-aware approach to message clustering guided by type information. The approach regards a message as a combination of n-grams, and it employs the Latent Dirichlet Allocation (LDA) model to characterize messages with types and n-grams via inferring the type distribution of each message. The type distribution is finally used to measure the similarity of messages. According to this similarity, the approach clusters messages and further extracts message formats. Experimental results of the approach against Netzob in terms of a number of protocols indicate that the correctness and conciseness can be significantly improved, e.g., figures 43.86% and 3.87%, respectively for the CoAP protocol. |
| format | Article |
| id | doaj-art-ebe61806f8a045ac8185e0334efc7021 |
| institution | Directory of Open Access Journals |
| issn | 1424-8220 |
| language | English |
| publishDate | 2019-02-01 |
| publisher | MDPI AG |
| record_format | Article |
| spelling | doaj-art-ebe61806f8a045ac8185e0334efc70212025-08-19T20:53:42ZengMDPI AGSensors1424-82202019-02-0119371610.3390/s19030716s19030716A Type-Aware Approach to Message Clustering for Protocol Reverse EngineeringXin Luo0Dan Chen1Yongjun Wang2Peidai Xie3College of Computer, National University of Defense Technology, Changsha 410073, ChinaSchool of Cyberspace Security, Hangzhou Dianzi University, Hangzhou 310018, ChinaCollege of Computer, National University of Defense Technology, Changsha 410073, ChinaCollege of Computer, National University of Defense Technology, Changsha 410073, ChinaProtocol Reverse Engineering (PRE) is crucial for information security of Internet-of-Things (IoT), and message clustering determines the effectiveness of PRE. However, the quality of services still lags behind the strict requirement of IoT applications as the results of message clustering are often coarse-grained with the intrinsic type information hidden in messages largely ignored. Aiming at this problem, this study proposes a type-aware approach to message clustering guided by type information. The approach regards a message as a combination of n-grams, and it employs the Latent Dirichlet Allocation (LDA) model to characterize messages with types and n-grams via inferring the type distribution of each message. The type distribution is finally used to measure the similarity of messages. According to this similarity, the approach clusters messages and further extracts message formats. Experimental results of the approach against Netzob in terms of a number of protocols indicate that the correctness and conciseness can be significantly improved, e.g., figures 43.86% and 3.87%, respectively for the CoAP protocol.https://www.mdpi.com/1424-8220/19/3/716message clusteringprotocol reverse engineeringInternet of Thingsinformation security |
| spellingShingle | Xin Luo Dan Chen Yongjun Wang Peidai Xie A Type-Aware Approach to Message Clustering for Protocol Reverse Engineering message clustering protocol reverse engineering Internet of Things information security |
| title | A Type-Aware Approach to Message Clustering for Protocol Reverse Engineering |
| title_full | A Type-Aware Approach to Message Clustering for Protocol Reverse Engineering |
| title_fullStr | A Type-Aware Approach to Message Clustering for Protocol Reverse Engineering |
| title_full_unstemmed | A Type-Aware Approach to Message Clustering for Protocol Reverse Engineering |
| title_short | A Type-Aware Approach to Message Clustering for Protocol Reverse Engineering |
| title_sort | type aware approach to message clustering for protocol reverse engineering |
| topic | message clustering protocol reverse engineering Internet of Things information security |
| url | https://www.mdpi.com/1424-8220/19/3/716 |
| work_keys_str_mv | AT xinluo atypeawareapproachtomessageclusteringforprotocolreverseengineering AT danchen atypeawareapproachtomessageclusteringforprotocolreverseengineering AT yongjunwang atypeawareapproachtomessageclusteringforprotocolreverseengineering AT peidaixie atypeawareapproachtomessageclusteringforprotocolreverseengineering AT xinluo typeawareapproachtomessageclusteringforprotocolreverseengineering AT danchen typeawareapproachtomessageclusteringforprotocolreverseengineering AT yongjunwang typeawareapproachtomessageclusteringforprotocolreverseengineering AT peidaixie typeawareapproachtomessageclusteringforprotocolreverseengineering |