TWC: Small: Semantics Aware Approaches to Automated Reverse Engineering Unknown Application Protocols

互联网上的许多应用程序协议，特别是恶意软件使用的应用程序协议，都是专有的，没有公开发布的规范。根据Internet2 NetFlow每周关于主干流量的报告，超过40%的互联网流量属于不明应用协议。因此，了解这些未知应用协议的规范对于网络安全解决方案至关重要。例如，在高级入侵防御系统中，需要协议规范来解析未知的应用协议。协议规范对于漏洞发现和系统集成等许多其他应用也很有用。此外，即使对于一些已知规范的应用协议，有时也需要协议推理来识别未明确指定的实现细节和错误。因此，未知应用协议的协议规范推断是网络安全的基础，本项目的目标是开发一种根据未知应用的网络痕迹自动推断未知应用的协议规范的方案。PI提出了一种语义感知的方法，该方法将网络痕迹作为输入，并自动输出推断的协议消息格式。这个项目代表了开发协议推理的语义感知方法的第一次努力，协议推理是许多网络安全解决方案的基本构建块。该项目具有潜在的变革性研究，具有很高的影响力。它将支持一系列新的网络安全应用和解决方案。拟议的项目是跨学科的，因为它将自然语言处理技术应用于网络安全问题。

Many application protocols on the Internet, especially those used by malware, are proprietary and have no publicly released specifications. According to the Internet2 NetFlow weekly reports on backbone traffic, more than 40% of Internet traffic belongs to unidentified application protocols. Therefore, it is critical for network security solutions to understand the specifications of these unknown application protocols. For instance, protocol specifications are needed for parsing unknown application protocol in advanced intrusion prevention systems. Protocol specifications are also useful for many other applications such as vulnerability discovery and system integration. Furthermore, even for some application protocols with known specifications, protocol inference is also needed sometimes for identifying implementation details and bugs that are not unambiguously specified. Inferring protocol specification for unknown application protocols is therefore fundamental to network security.The objective of this project is to develop schemes for automatically inferring the protocol specification of unknown applications from their network traces. The PI proposes a semantics aware approach that takes network traces as the input and automatically outputs the inferred protocol message format. This project represents the first effort towards developing semantics aware approaches to protocol inference, a fundamental building block of many network security solutions. This project is potentially transformative research with high-impact. It will enable a spectrum of new network security applications and solutions. The proposed project is interdisciplinary in nature as it applies natural language processing techniques to network security problems.