Inferência Automática de Protocolos de Rede

Abstract

Reverse engineering of network protocols is an area of security research. Given the fact that the inferring the structure of a protocol, when done manually or using the documentation of the protocol as an input, tend to be time consuming and error prone. Given the disadvantages of the manual execution of such a process, many authors proposed approaches with the objective of optimization and automation of the process. Some of these approaches will be analyzed, considerations will be presented under the perspective of advantages and disadvantages of these approaches, one of these will be selected given the perspective of generalization and automation. From that point an implementation of the selected approach is presented which seek to automate the inference of protocol. Based on the results presented which consists in two metrics: mutation rate, used to infer the behaviour of checksums and alternation rate, user to infer the behaviour of addresses; and other parameters like the most recurrent type of possible interpretation of a given byte, with this it's possible to group arbitrary streams of bytes in a way that resemble the structure of the given protocols. From that it's possible to generate the finite state automata that represent the inferred format of the protocol.