Affiliations: [a]
School of Information Science and Technology, Zhongkai University of Agriculture and Engineering, Guangzhou, China
| [b]
Information Center, Guang Dong Entry-Exit Inspection and Quarantine Bureau, Zhujiang Newtown, Guangzhou, China
Correspondence:
[*]
Corresponding author. Ming-Ming Xiao, School of Information Science and Technology, Zhongkai University of Agriculture and Engineering, Dongsha Street No. 24, Fangzhi Road, Guangzhou, China. Tel.: +86 20 89003200; Fax: +86 20 89002069; E-mail: xmingm@mail2.sysu.edu.cn.
Abstract: An effective method for reverse engineering message format specification is proposed, which is a necessary step to extract the protocol’s state machine. First, separators are scanned and compared to accomplish protocol fields partitioned hierarchically, so as to determine the field boundaries recursively and achieve the basic field; second, the protocol candidate tokens are extracted by frequency statistics; finally, the logic feature selector is designed for filtering the logic feature keywords. The experimental valuation demonstrates the validation of partitioning fields and extracting logic feature keyword.
