Affiliations: [a] School of Information Science and Technology, Zhongkai University of Agriculture and Engineering, Guangzhou, P.R. China | [b] Information Center, Guang Dong Entry-Exit Inspection and Quarantine Bureau, Zhujiang Newtown, Tianhe District, Guangzhou, China
Correspondence:
[*]
Corresponding author. Ming-Ming Xiao, School of Information Science and Technology, Zhongkai University of
Agriculture and Engineering, 24 Dongsha Street, Fangzhi Road, Guangzhou, P.R. China. Tel.: +86 20 89003200; Fax:
+86 20 89002069;E-mail: xmingm@mail2.sysu.edu.cn.
Abstract: For a thorough understanding of procedures in various network applications, and to automatically classify, recognize, trace, and control them, it is necessary that the state machine representing application sessions is obtained in advance. This article presents a novel approach to reversely infer a protocol state machine from collected data of the application layer. Protocol state machines are derived using a method of error-correcting grammatical inference, which is based on symbol sequences that appear in the application sessions. The techniques are implemented into a tool called PREUGI, which is conducted in a real network, containing a number of real applications with several application layer protocols, to validate the proposed method.
