Protocol Reverse Engineering by Analysis of the Probability Distribution of Messages

Abstract

The protocol reverse engineering is becoming more and more important because of the unknown protocols. This study proposes a protocol reverse method, based on the network traffic, which uses the probability distribution relationship between the fields to analyze the field boundaries. The experimental results show that the algorithm is better than Netzob in running results and time.