{"id":"https://openalex.org/W2131242596","doi":"https://doi.org/10.1109/cisda.2009.5356565","title":"Traffic to protocol reverse engineering","display_name":"Traffic to protocol reverse engineering","publication_year":2009,"publication_date":"2009-07-01","ids":{"openalex":"https://openalex.org/W2131242596","doi":"https://doi.org/10.1109/cisda.2009.5356565","mag":"2131242596"},"language":"en","primary_location":{"id":"doi:10.1109/cisda.2009.5356565","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cisda.2009.5356565","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5084936202","display_name":"Antonio Trifilo","orcid":null},"institutions":[{"id":"https://openalex.org/I59105498","display_name":"Swisscom (Switzerland)","ror":"https://ror.org/04t1f4f50","country_code":"CH","type":"company","lineage":["https://openalex.org/I59105498"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"Antonio Trifilo","raw_affiliation_strings":["Swisscom (Schweiz) AG, Bern, Switzerland","Swisscom Schweiz AG, Bern, Switzerland"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Swisscom (Schweiz) AG, Bern, Switzerland","institution_ids":["https://openalex.org/I59105498"]},{"raw_affiliation_string":"Swisscom Schweiz AG, Bern, Switzerland","institution_ids":["https://openalex.org/I59105498"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5013126732","display_name":"Stefan Burschka","orcid":null},"institutions":[{"id":"https://openalex.org/I59105498","display_name":"Swisscom (Switzerland)","ror":"https://ror.org/04t1f4f50","country_code":"CH","type":"company","lineage":["https://openalex.org/I59105498"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"Stefan Burschka","raw_affiliation_strings":["Swisscom (Schweiz) AG, Bern, Switzerland","Swisscom Schweiz AG, Bern, Switzerland"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Swisscom (Schweiz) AG, Bern, Switzerland","institution_ids":["https://openalex.org/I59105498"]},{"raw_affiliation_string":"Swisscom Schweiz AG, Bern, Switzerland","institution_ids":["https://openalex.org/I59105498"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5078505828","display_name":"Ernst W. Biersack","orcid":null},"institutions":[{"id":"https://openalex.org/I1902872","display_name":"EURECOM","ror":"https://ror.org/00sse7z02","country_code":"FR","type":"education","lineage":["https://openalex.org/I1902872","https://openalex.org/I205703379"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Ernst Biersack","raw_affiliation_strings":["Internet Research Group, Eurecom Institute, Sophia-Antipolis, France","Internet Research Group at Eurecom, Sophia Antipolis, France#TAB#"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Internet Research Group, Eurecom Institute, Sophia-Antipolis, France","institution_ids":["https://openalex.org/I1902872"]},{"raw_affiliation_string":"Internet Research Group at Eurecom, Sophia Antipolis, France#TAB#","institution_ids":["https://openalex.org/I1902872"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":2.2585,"has_fulltext":false,"cited_by_count":44,"citation_normalized_percentile":{"value":0.8929558,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"8"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9986000061035156,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/dynamic-host-configuration-protocol","display_name":"Dynamic Host Configuration Protocol","score":0.8618533611297607},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8230973482131958},{"id":"https://openalex.org/keywords/reverse-engineering","display_name":"Reverse engineering","score":0.7772725820541382},{"id":"https://openalex.org/keywords/protocol","display_name":"Protocol (science)","score":0.6379559636116028},{"id":"https://openalex.org/keywords/construct","display_name":"Construct (python library)","score":0.5903156995773315},{"id":"https://openalex.org/keywords/state","display_name":"State (computer science)","score":0.5776451826095581},{"id":"https://openalex.org/keywords/scripting-language","display_name":"Scripting language","score":0.5475486516952515},{"id":"https://openalex.org/keywords/honeypot","display_name":"Honeypot","score":0.5383177399635315},{"id":"https://openalex.org/keywords/field","display_name":"Field (mathematics)","score":0.481038361787796},{"id":"https://openalex.org/keywords/distributed-computing","display_name":"Distributed computing","score":0.47012460231781006},{"id":"https://openalex.org/keywords/transmission-control-protocol","display_name":"Transmission Control Protocol","score":0.41430631279945374},{"id":"https://openalex.org/keywords/binary-number","display_name":"Binary number","score":0.4118526875972748},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.39955902099609375},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.3874766528606415},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.3488430976867676},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.2814924120903015}],"concepts":[{"id":"https://openalex.org/C26876914","wikidata":"https://www.wikidata.org/wiki/Q11166","display_name":"Dynamic Host Configuration Protocol","level":3,"score":0.8618533611297607},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8230973482131958},{"id":"https://openalex.org/C207850805","wikidata":"https://www.wikidata.org/wiki/Q269608","display_name":"Reverse engineering","level":2,"score":0.7772725820541382},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.6379559636116028},{"id":"https://openalex.org/C2780801425","wikidata":"https://www.wikidata.org/wiki/Q5164392","display_name":"Construct (python library)","level":2,"score":0.5903156995773315},{"id":"https://openalex.org/C48103436","wikidata":"https://www.wikidata.org/wiki/Q599031","display_name":"State (computer science)","level":2,"score":0.5776451826095581},{"id":"https://openalex.org/C61423126","wikidata":"https://www.wikidata.org/wiki/Q187432","display_name":"Scripting language","level":2,"score":0.5475486516952515},{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.5383177399635315},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.481038361787796},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.47012460231781006},{"id":"https://openalex.org/C33588617","wikidata":"https://www.wikidata.org/wiki/Q8803","display_name":"Transmission Control Protocol","level":3,"score":0.41430631279945374},{"id":"https://openalex.org/C48372109","wikidata":"https://www.wikidata.org/wiki/Q3913","display_name":"Binary number","level":2,"score":0.4118526875972748},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.39955902099609375},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.3874766528606415},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.3488430976867676},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.2814924120903015},{"id":"https://openalex.org/C142724271","wikidata":"https://www.wikidata.org/wiki/Q7208","display_name":"Pathology","level":1,"score":0.0},{"id":"https://openalex.org/C204787440","wikidata":"https://www.wikidata.org/wiki/Q188504","display_name":"Alternative medicine","level":2,"score":0.0},{"id":"https://openalex.org/C2985371682","wikidata":"https://www.wikidata.org/wiki/Q11135","display_name":"Ip address","level":2,"score":0.0},{"id":"https://openalex.org/C202444582","wikidata":"https://www.wikidata.org/wiki/Q837863","display_name":"Pure mathematics","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C94375191","wikidata":"https://www.wikidata.org/wiki/Q11205","display_name":"Arithmetic","level":1,"score":0.0},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.0},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/cisda.2009.5356565","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cisda.2009.5356565","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications","raw_type":"proceedings-article"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.161.2189","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.161.2189","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.eurecom.fr/~btroup/BPublished/TrafficREG.pdf","raw_type":"text"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.6100000143051147,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":11,"referenced_works":["https://openalex.org/W1489157620","https://openalex.org/W1538375546","https://openalex.org/W1921075642","https://openalex.org/W2131242596","https://openalex.org/W2131875129","https://openalex.org/W2137623823","https://openalex.org/W2164253698","https://openalex.org/W2172163424","https://openalex.org/W6629319858","https://openalex.org/W6632460521","https://openalex.org/W6685277877"],"related_works":["https://openalex.org/W2789663798","https://openalex.org/W2375896275","https://openalex.org/W4230913293","https://openalex.org/W2166943775","https://openalex.org/W2775236000","https://openalex.org/W2073762068","https://openalex.org/W2151915331","https://openalex.org/W2071426633","https://openalex.org/W2349754162","https://openalex.org/W3206844599"],"abstract_inverted_index":{"Network":[0],"Protocol":[1],"Reverse":[2],"Engineering":[3],"(NPRE)":[4],"has":[5],"played":[6],"an":[7],"increasing":[8],"role":[9],"in":[10,38],"honeypot":[11],"operations.":[12],"It":[13],"allows":[14],"to":[15,23,46,64,74,83,108,115],"automatically":[16,51],"generate":[17],"Statemodels":[18],"and":[19,102,121],"scripts":[20],"being":[21],"able":[22],"act":[24],"as":[25],"realistic":[26],"counterpart":[27],"for":[28],"capturing":[29],"unknown":[30],"malware.":[31],"This":[32],"work":[33],"proposes":[34],"a":[35,71,85,123],"novel":[36],"approach":[37],"the":[39,53,58,62,76,94,110,113],"field":[40],"of":[41,57,97],"NPRE.":[42],"By":[43],"passively":[44],"listening":[45],"network":[47],"traces,":[48],"our":[49,90],"system":[50],"derives":[52],"protocol":[54],"state":[55,86,95],"machines":[56],"peers":[59],"involved":[60],"allowing":[61],"analyst":[63],"understand":[65],"its":[66],"intrinsic":[67],"logic.":[68],"We":[69,88,104],"present":[70],"new":[72,124],"methodology":[73,91],"extract":[75],"relevant":[77],"fields":[78],"from":[79],"arbitrary":[80],"binary":[81,117],"protocols":[82,99],"construct":[84],"model.":[87],"prove":[89],"by":[92],"deriving":[93],"machine":[96],"documented":[98],"ARP,":[100],"DHCP":[101],"TCP.":[103],"then":[105],"apply":[106],"it":[107],"Kademlia,":[109],"results":[111],"show":[112],"usefulness":[114],"support":[116],"reverse":[118],"engineering":[119],"processes":[120],"detect":[122],"undocumented":[125],"feature.":[126]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":1},{"year":2023,"cited_by_count":2},{"year":2022,"cited_by_count":6},{"year":2021,"cited_by_count":5},{"year":2020,"cited_by_count":3},{"year":2019,"cited_by_count":4},{"year":2018,"cited_by_count":3},{"year":2017,"cited_by_count":2},{"year":2016,"cited_by_count":3},{"year":2015,"cited_by_count":1},{"year":2014,"cited_by_count":1},{"year":2013,"cited_by_count":5}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}