BaNet3F: a Bayesian network approach to automatic binary frame format identification

Abstract

In the fast developing world of telecommunications, it may be useful to analyse any protocol one comes across, even if it is unknown. To that end, one needs to get the state machine and the frame format of the protocol. These can be extracted from network and/or execution traces via Protocol Reverse Engineering (PRE). In this paper, we present BaNet3F, a model aimed at finding the hidden structure of binary protocol frames. To quantify the complexity of the traces analysed (from BaNet3F perspective), we suggest a new meaningful metric: the Average Dependencies Ratio (ADR). We then compare the proposed model to two state-of-the-art ones, Latent Dirichlet Allocation (LDA) and Cai et al. model, and show that BaNet3F outperforms them by far.