{"id":"https://openalex.org/W179510128","doi":null,"title":"Automatic Protocol Format Reverse Engineering through Context-Aware Monitored Execution.","display_name":"Automatic Protocol Format Reverse Engineering through Context-Aware Monitored Execution.","publication_year":2008,"publication_date":"2008-01-01","ids":{"openalex":"https://openalex.org/W179510128","mag":"179510128"},"language":"en","primary_location":{"id":"pmh:oai:CiteSeerX.psu:10.1.1.120.2651","doi":null,"is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.120.2651","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.isoc.org/isoc/conferences/ndss/08/papers/14_automatic_protocol_format.pdf","raw_type":"text"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":[],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5026864098","display_name":"Zhiqiang Lin","orcid":"https://orcid.org/0000-0001-6527-5994","observed_orcids":["https://orcid.org/0000-0001-6527-5994"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhiqiang Lin","raw_affiliation_strings":[],"raw_orcid":"https://orcid.org/0000-0001-6527-5994","affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5109035300","display_name":"Xuxian Jiang","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xuxian Jiang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5108280598","display_name":"Dongyan Xu","orcid":"https://orcid.org/0000-0002-9892-8733","observed_orcids":["https://orcid.org/0000-0002-9892-8733"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Dongyan Xu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5100362457","display_name":"Xiangyu Zhang","orcid":"https://orcid.org/0000-0002-5273-4765","observed_orcids":["https://orcid.org/0000-0002-5273-4765","https://orcid.org/0000-0002-9544-2500"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xiangyu Zhang","raw_affiliation_strings":[],"raw_orcid":"https://orcid.org/0000-0002-5273-4765","affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":13.9665,"has_fulltext":false,"cited_by_count":206,"citation_normalized_percentile":{"value":0.99435055,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":93,"max":100},"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.3677000105381012,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.3677000105381012,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.2110999971628189,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.11509999632835388,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/protocol-reverse-engineering","display_name":"protocol reverse engineering","score":0.8999999761581421},{"id":"https://openalex.org/keywords/call-stack","display_name":"call stack","score":0.7329999804496765},{"id":"https://openalex.org/keywords/network-traffic-traces","display_name":"network traces","score":0.656000018119812}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8638978004455566},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.6808661818504333},{"id":"https://openalex.org/C207850805","wikidata":"https://www.wikidata.org/wiki/Q269608","display_name":"Reverse engineering","level":2,"score":0.5674001574516296},{"id":"https://openalex.org/C76885553","wikidata":"https://www.wikidata.org/wiki/Q957589","display_name":"Tunneling protocol","level":4,"score":0.47241297364234924},{"id":"https://openalex.org/C110738861","wikidata":"https://www.wikidata.org/wiki/Q682598","display_name":"Real Time Streaming Protocol","level":3,"score":0.4390672743320465},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.4315243065357208},{"id":"https://openalex.org/C43364308","wikidata":"https://www.wikidata.org/wiki/Q8799","display_name":"Byte","level":2,"score":0.43074706196784973},{"id":"https://openalex.org/C111009948","wikidata":"https://www.wikidata.org/wiki/Q1067690","display_name":"Two-phase commit protocol","level":5,"score":0.4277384281158447},{"id":"https://openalex.org/C75114861","wikidata":"https://www.wikidata.org/wiki/Q594324","display_name":"General Inter-ORB Protocol","level":5,"score":0.42670440673828125},{"id":"https://openalex.org/C70522964","wikidata":"https://www.wikidata.org/wiki/Q220169","display_name":"Open Shortest Path First","level":5,"score":0.42613664269447327},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.3934510350227356},{"id":"https://openalex.org/C20636137","wikidata":"https://www.wikidata.org/wiki/Q11163","display_name":"User Datagram Protocol","level":4,"score":0.3897307217121124},{"id":"https://openalex.org/C65567647","wikidata":"https://www.wikidata.org/wiki/Q81414","display_name":"Internet protocol suite","level":3,"score":0.3698654770851135},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.3334396481513977},{"id":"https://openalex.org/C104954878","wikidata":"https://www.wikidata.org/wiki/Q1648707","display_name":"Routing protocol","level":3,"score":0.2843201756477356},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.24056476354599},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.21027114987373352},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.19783660769462585},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.1278216540813446},{"id":"https://openalex.org/C72108876","wikidata":"https://www.wikidata.org/wiki/Q844565","display_name":"Transaction processing","level":3,"score":0.10024657845497131},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0},{"id":"https://openalex.org/C89305328","wikidata":"https://www.wikidata.org/wiki/Q1755411","display_name":"Link-state routing protocol","level":4,"score":0.0},{"id":"https://openalex.org/C75949130","wikidata":"https://www.wikidata.org/wiki/Q848010","display_name":"Database transaction","level":2,"score":0.0},{"id":"https://openalex.org/C142724271","wikidata":"https://www.wikidata.org/wiki/Q7208","display_name":"Pathology","level":1,"score":0.0},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C25185021","wikidata":"https://www.wikidata.org/wiki/Q4053284","display_name":"Distributed transaction","level":4,"score":0.0},{"id":"https://openalex.org/C204787440","wikidata":"https://www.wikidata.org/wiki/Q188504","display_name":"Alternative medicine","level":2,"score":0.0}],"mesh":[],"locations_count":4,"locations":[{"id":"pmh:oai:CiteSeerX.psu:10.1.1.120.2651","doi":null,"is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.120.2651","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.isoc.org/isoc/conferences/ndss/08/papers/14_automatic_protocol_format.pdf","raw_type":"text"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.153.3806","doi":null,"is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.153.3806","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.cs.purdue.edu/homes/zlin/file/AutoFormat_NDSS08.pdf","raw_type":"text"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.80.8873","doi":null,"is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.80.8873","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.cs.purdue.edu/homes/dxu/pubs/NDSS08.pdf","raw_type":"text"},{"id":"mag:179510128","doi":null,"is_oa":false,"landing_page_url":"https://www.isoc.org/isoc/conferences/ndss/08/papers/14_automatic_protocol_format.pdf","pdf_url":null,"source":{"id":"https://openalex.org/S4306420590","display_name":"Network and Distributed System Security Symposium","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":"Network and Distributed System Security Symposium","raw_type":null}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":25,"referenced_works":["https://openalex.org/W33043110","https://openalex.org/W1222699389","https://openalex.org/W1482382132","https://openalex.org/W1489157620","https://openalex.org/W1499241274","https://openalex.org/W1516506771","https://openalex.org/W1538375546","https://openalex.org/W1548740378","https://openalex.org/W1921075642","https://openalex.org/W1978063312","https://openalex.org/W2014589236","https://openalex.org/W2049867480","https://openalex.org/W2100666033","https://openalex.org/W2102970979","https://openalex.org/W2117470854","https://openalex.org/W2117636524","https://openalex.org/W2131875129","https://openalex.org/W2134633067","https://openalex.org/W2136337200","https://openalex.org/W2148346742","https://openalex.org/W2151135920","https://openalex.org/W2156858199","https://openalex.org/W2163762767","https://openalex.org/W2164253698","https://openalex.org/W2172163424"],"related_works":["https://openalex.org/W2172163424","https://openalex.org/W7151352587","https://openalex.org/W4206194194","https://openalex.org/W2903489318","https://openalex.org/W7128521209","https://openalex.org/W1538375546","https://openalex.org/W7098758010","https://openalex.org/W2514819619","https://openalex.org/W4404955166","https://openalex.org/W7100084424"],"abstract_inverted_index":{"Protocol":[0],"reverse":[1,33],"engineering":[2],"has":[3],"often":[4],"been":[5,26],"a":[6,20,69,196],"manual":[7],"process":[8],"that":[9,73,102,202],"is":[10,96],"considered":[11],"time-consuming,":[12],"tedious":[13],"and":[14,148,175,182,212,241],"error-prone.":[15],"To":[16],"address":[17],"this":[18,65],"limitation,":[19],"number":[21],"of":[22,47,61,92,230],"solutions":[23],"have":[24,157],"recently":[25],"proposed":[27],"to":[28,45,151],"allow":[29],"for":[30,136],"automatic":[31],"protocol":[32,42,62,79,93,104,154,165,186,193,232],"engineering.":[34],"Unfortunately,":[35],"they":[36],"are":[37,110],"either":[38],"limited":[39],"in":[40,50,55,106,113,144],"extracting":[41,78],"fields":[43,80,105,210],"due":[44],"lack":[46],"program":[48,127],"semantics":[49],"network":[51],"traces":[52],"or":[53],"primitive":[54],"only":[56,77,206],"revealing":[57,86,235],"the":[58,87,99,107,118,126,132,145,153,228,231,244],"flat":[59],"structure":[60,229],"format.":[63,155],"In":[64],"paper,":[66],"we":[67,129],"present":[68],"system":[70,160],"called":[71],"AutoFormat":[72,95,203],"aims":[74],"at":[75],"not":[76,205],"with":[81,141,161,213,223],"high":[82,214],"accuracy,":[83],"but":[84,225],"also":[85,226],"inherently":[88],"\u201cnon-flat\u201d,":[89],"hierarchical":[90],"structures":[91],"messages.":[94],"based":[97],"on":[98],"key":[100],"insight":[101],"different":[103,114],"same":[108],"message":[109,138,209,245],"typically":[111],"handled":[112],"execution":[115,133],"contexts":[116],"(e.g.,":[117,238],"runtime":[119],"call":[120],"stack).":[121],"As":[122],"such,":[123],"by":[124,195,234],"monitoring":[125],"execution,":[128],"can":[130,204],"collect":[131],"context":[134],"information":[135],"every":[137],"byte":[139],"(annotated":[140],"its":[142],"offset":[143],"entire":[146],"message)":[147],"cluster":[149],"them":[150],"derive":[152],"We":[156],"evaluated":[158],"our":[159],"more":[162],"than":[163],"30":[164],"messages":[166],"from":[167],"seven":[168],"protocols,":[169],"including":[170],"two":[171],"text-based":[172],"protocols":[173,179],"(HTTP":[174],"SIP),":[176],"three":[177],"binary-based":[178],"(DHCP,":[180],"RIP,":[181],"OSPF),":[183],"one":[184,191],"hybrid":[185],"(CIFS/SMB),":[187],"as":[188,190],"well":[189],"unknown":[192],"used":[194],"real-world":[197],"malware.":[198],"Our":[199],"results":[200],"show":[201],"identify":[207],"individual":[208],"automatically":[211],"accuracy":[215],"(an":[216],"average":[217],"93.4":[218],"%":[219],"match":[220],"ratio":[221],"compared":[222],"Wireshark),":[224],"unveil":[227],"format":[233],"possible":[236],"relations":[237],"sequential,":[239],"parallel,":[240],"hierarchical)":[242],"among":[243],"fields.":[246]},"counts_by_year":[{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":9},{"year":2023,"cited_by_count":9},{"year":2022,"cited_by_count":8},{"year":2021,"cited_by_count":7},{"year":2020,"cited_by_count":7},{"year":2019,"cited_by_count":11},{"year":2018,"cited_by_count":14},{"year":2017,"cited_by_count":9},{"year":2016,"cited_by_count":13},{"year":2015,"cited_by_count":19},{"year":2014,"cited_by_count":14},{"year":2013,"cited_by_count":14},{"year":2012,"cited_by_count":17}],"updated_date":"2026-11-04T10:54:05.112534","created_date":"2016-06-24T00:00:00"}