{"id":"https://openalex.org/W2903489318","doi":"https://doi.org/10.23919/softcom.2018.8555813","title":"Message Format and Field Semantics Inference for Binary Protocols Using Recorded Network Traffic","display_name":"Message Format and Field Semantics Inference for Binary Protocols Using Recorded Network Traffic","publication_year":2018,"publication_date":"2018-09-01","ids":{"openalex":"https://openalex.org/W2903489318","doi":"https://doi.org/10.23919/softcom.2018.8555813","mag":"2903489318"},"language":"en","primary_location":{"id":"doi:10.23919/softcom.2018.8555813","is_oa":false,"landing_page_url":"https://doi.org/10.23919/softcom.2018.8555813","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2018 26th International Conference on Software, Telecommunications and Computer Networks (SoftCOM)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5086379146","display_name":"Gerg\u0151 L\u00e1di","orcid":"https://orcid.org/0000-0002-0318-2175"},"institutions":[{"id":"https://openalex.org/I29770179","display_name":"Budapest University of Technology and Economics","ror":"https://ror.org/02w42ss30","country_code":"HU","type":"education","lineage":["https://openalex.org/I29770179"]}],"countries":["HU"],"is_corresponding":false,"raw_author_name":"Gergo Ladi","raw_affiliation_strings":["Department of Networked Systems and Services, Laboratory of Cryptography and System Security, Budapest University of Technology and Economics, Budapest, Hungary"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Networked Systems and Services, Laboratory of Cryptography and System Security, Budapest University of Technology and Economics, Budapest, Hungary","institution_ids":["https://openalex.org/I29770179"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5063012203","display_name":"Levente Butty\u00e1n","orcid":"https://orcid.org/0000-0003-4233-2559"},"institutions":[{"id":"https://openalex.org/I29770179","display_name":"Budapest University of Technology and Economics","ror":"https://ror.org/02w42ss30","country_code":"HU","type":"education","lineage":["https://openalex.org/I29770179"]}],"countries":["HU"],"is_corresponding":false,"raw_author_name":"Levente Buttyan","raw_affiliation_strings":["Department of Networked Systems and Services, Laboratory of Cryptography and System Security, Budapest University of Technology and Economics, Budapest, Hungary"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Networked Systems and Services, Laboratory of Cryptography and System Security, Budapest University of Technology and Economics, Budapest, Hungary","institution_ids":["https://openalex.org/I29770179"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5050897833","display_name":"Tam\u00e1s Holczer","orcid":"https://orcid.org/0000-0003-0953-5397"},"institutions":[{"id":"https://openalex.org/I29770179","display_name":"Budapest University of Technology and Economics","ror":"https://ror.org/02w42ss30","country_code":"HU","type":"education","lineage":["https://openalex.org/I29770179"]}],"countries":["HU"],"is_corresponding":false,"raw_author_name":"Tamas Holczer","raw_affiliation_strings":["Department of Networked Systems and Services, Laboratory of Cryptography and System Security, Budapest University of Technology and Economics, Budapest, Hungary"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Networked Systems and Services, Laboratory of Cryptography and System Security, Budapest University of Technology and Economics, Budapest, Hungary","institution_ids":["https://openalex.org/I29770179"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I29770179"],"apc_list":null,"apc_paid":null,"fwci":2.1438,"has_fulltext":false,"cited_by_count":27,"citation_normalized_percentile":{"value":0.91396264,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8599774241447449},{"id":"https://openalex.org/keywords/reverse-engineering","display_name":"Reverse engineering","score":0.6714560389518738},{"id":"https://openalex.org/keywords/reverse-address-resolution-protocol","display_name":"Reverse Address Resolution Protocol","score":0.6092270016670227},{"id":"https://openalex.org/keywords/protocol","display_name":"Protocol (science)","score":0.5995744466781616},{"id":"https://openalex.org/keywords/modbus","display_name":"Modbus","score":0.49027279019355774},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.47621068358421326},{"id":"https://openalex.org/keywords/tunneling-protocol","display_name":"Tunneling protocol","score":0.4460844397544861},{"id":"https://openalex.org/keywords/communications-protocol","display_name":"Communications protocol","score":0.44246309995651245},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.4293980598449707},{"id":"https://openalex.org/keywords/universal-composability","display_name":"Universal composability","score":0.4108864665031433},{"id":"https://openalex.org/keywords/distributed-computing","display_name":"Distributed computing","score":0.38570815324783325},{"id":"https://openalex.org/keywords/internet-protocol-suite","display_name":"Internet protocol suite","score":0.29721295833587646},{"id":"https://openalex.org/keywords/cryptographic-protocol","display_name":"Cryptographic protocol","score":0.26298877596855164},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.25751280784606934},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.1757735311985016},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.15879392623901367},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.15489166975021362},{"id":"https://openalex.org/keywords/cryptography","display_name":"Cryptography","score":0.09746718406677246}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8599774241447449},{"id":"https://openalex.org/C207850805","wikidata":"https://www.wikidata.org/wiki/Q269608","display_name":"Reverse engineering","level":2,"score":0.6714560389518738},{"id":"https://openalex.org/C71065454","wikidata":"https://www.wikidata.org/wiki/Q721869","display_name":"Reverse Address Resolution Protocol","level":4,"score":0.6092270016670227},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.5995744466781616},{"id":"https://openalex.org/C2776666747","wikidata":"https://www.wikidata.org/wiki/Q1135322","display_name":"Modbus","level":3,"score":0.49027279019355774},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.47621068358421326},{"id":"https://openalex.org/C76885553","wikidata":"https://www.wikidata.org/wiki/Q957589","display_name":"Tunneling protocol","level":4,"score":0.4460844397544861},{"id":"https://openalex.org/C12269588","wikidata":"https://www.wikidata.org/wiki/Q132364","display_name":"Communications protocol","level":2,"score":0.44246309995651245},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.4293980598449707},{"id":"https://openalex.org/C165751822","wikidata":"https://www.wikidata.org/wiki/Q7894118","display_name":"Universal composability","level":4,"score":0.4108864665031433},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.38570815324783325},{"id":"https://openalex.org/C65567647","wikidata":"https://www.wikidata.org/wiki/Q81414","display_name":"Internet protocol suite","level":3,"score":0.29721295833587646},{"id":"https://openalex.org/C33884865","wikidata":"https://www.wikidata.org/wiki/Q1254335","display_name":"Cryptographic protocol","level":3,"score":0.26298877596855164},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.25751280784606934},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.1757735311985016},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.15879392623901367},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.15489166975021362},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.09746718406677246},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.0},{"id":"https://openalex.org/C204787440","wikidata":"https://www.wikidata.org/wiki/Q188504","display_name":"Alternative medicine","level":2,"score":0.0},{"id":"https://openalex.org/C142724271","wikidata":"https://www.wikidata.org/wiki/Q7208","display_name":"Pathology","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.23919/softcom.2018.8555813","is_oa":false,"landing_page_url":"https://doi.org/10.23919/softcom.2018.8555813","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2018 26th International Conference on Software, Telecommunications and Computer Networks (SoftCOM)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":24,"referenced_works":["https://openalex.org/W38765094","https://openalex.org/W77946476","https://openalex.org/W179510128","https://openalex.org/W1538375546","https://openalex.org/W1553308705","https://openalex.org/W1645900268","https://openalex.org/W2004929506","https://openalex.org/W2046640879","https://openalex.org/W2049867480","https://openalex.org/W2056325176","https://openalex.org/W2080329164","https://openalex.org/W2115675703","https://openalex.org/W2121972959","https://openalex.org/W2149382744","https://openalex.org/W2163762767","https://openalex.org/W2164253698","https://openalex.org/W2241428156","https://openalex.org/W2582379727","https://openalex.org/W6601496405","https://openalex.org/W6603227804","https://openalex.org/W6607214813","https://openalex.org/W6632460521","https://openalex.org/W6632977858","https://openalex.org/W6636805057"],"related_works":["https://openalex.org/W177177356","https://openalex.org/W2374988017","https://openalex.org/W2163429719","https://openalex.org/W2792204436","https://openalex.org/W4255875934","https://openalex.org/W72195266","https://openalex.org/W2097925624","https://openalex.org/W2381123248","https://openalex.org/W2237876205","https://openalex.org/W2957376705"],"abstract_inverted_index":{"Protocol":[0,59,73],"specifications":[1,21,54,68,139,194,198],"describe":[2],"the":[3,29,67,89,103,110,172,192,196],"interaction":[4],"between":[5],"different":[6],"entities":[7],"by":[8,177],"defining":[9,35],"message":[10,13,156],"formats":[11,157],"and":[12,40,52,188],"processing":[14],"rules.":[15],"Having":[16],"access":[17,101],"to":[18,65,102,195],"such":[19,70],"protocol":[20,43,104,111,138,155],"is":[22,62,114],"highly":[23],"desirable":[24],"for":[25,125,164],"many":[26,46,108],"tasks,":[27],"including":[28],"analysis":[30],"of":[31,48,69,174,183,199],"botnets,":[32],"building":[33],"honeypots,":[34],"network":[36,144,168],"intrusion":[37],"detection":[38],"rules,":[39],"fuzz":[41],"testing":[42],"implementations.":[44],"Unfortunately,":[45],"protocols":[47,166],"interest":[49],"are":[50,55],"proprietary,":[51],"their":[53],"not":[56,115,121],"publicly":[57],"available.":[58],"reverse":[60,74,90,126,136],"engineering":[61,75,91,127,137],"an":[63],"approach":[64,176],"reconstruct":[66],"closed":[71],"protocols.":[72,201],"can":[76,153],"be":[77],"tedious":[78],"work":[79],"if":[80],"done":[81],"manually,":[82],"so":[83],"prior":[84],"research":[85],"focused":[86],"on":[87,100,135,142,180],"automating":[88],"process":[92],"as":[93,95,158,160],"much":[94],"possible.":[96],"Some":[97],"approaches":[98],"rely":[99],"implementation,":[105],"but":[106],"in":[107,130],"cases,":[109],"implementation":[112],"itself":[113],"available":[116],"or":[117],"its":[118,123],"license":[119],"does":[120],"permit":[122],"use":[124],"purposes.":[128],"Hence,":[129],"this":[131],"paper,":[132],"we":[133,148],"focus":[134],"based":[140],"solely":[141],"recorded":[143],"traffic.":[145],"More":[146],"specifically,":[147],"propose":[149],"a":[150],"method":[151],"that":[152],"infer":[154],"well":[159],"certain":[161],"field":[162],"semantics":[163],"binary":[165],"from":[167],"traces.":[169],"We":[170],"demonstrate":[171],"usability":[173],"our":[175],"running":[178],"it":[179],"packet":[181],"captures":[182],"two":[184],"known":[185,197],"protocols,":[186],"Modbus":[187],"MQTT,":[189],"then":[190],"comparing":[191],"inferred":[193],"these":[200]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":3},{"year":2023,"cited_by_count":6},{"year":2022,"cited_by_count":1},{"year":2021,"cited_by_count":5},{"year":2020,"cited_by_count":6},{"year":2019,"cited_by_count":1}],"updated_date":"2026-08-12T21:12:35.861297","created_date":"2025-10-10T00:00:00"}