{"id":"https://openalex.org/W4385624863","doi":"https://doi.org/10.23919/tma58422.2023.10198881","title":"Packet Field Tree: a hybrid approach to automated protocol reverse-engineering","display_name":"Packet Field Tree: a hybrid approach to automated protocol reverse-engineering","publication_year":2023,"publication_date":"2023-06-26","ids":{"openalex":"https://openalex.org/W4385624863","doi":"https://doi.org/10.23919/tma58422.2023.10198881"},"language":"en","primary_location":{"id":"doi:10.23919/tma58422.2023.10198881","is_oa":false,"landing_page_url":"http://dx.doi.org/10.23919/tma58422.2023.10198881","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 7th Network Traffic Measurement and Analysis Conference (TMA)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5112228794","display_name":"A. L. Rohl","orcid":null},"institutions":[{"id":"https://openalex.org/I1303474014","display_name":"Defence Science and Technology Group","ror":"https://ror.org/05ddrvt52","country_code":"AU","type":"government","lineage":["https://openalex.org/I1303474014","https://openalex.org/I2801453606","https://openalex.org/I3139952251"]},{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Alex Rohl","raw_affiliation_strings":["University of Adelaide,Australia","Defence Science & Technology Group, Australia","University of Adelaide, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Adelaide,Australia","institution_ids":["https://openalex.org/I5681781"]},{"raw_affiliation_string":"Defence Science & Technology Group, Australia","institution_ids":["https://openalex.org/I1303474014"]},{"raw_affiliation_string":"University of Adelaide, Australia","institution_ids":["https://openalex.org/I5681781"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5016001264","display_name":"Matthew Roughan","orcid":"https://orcid.org/0000-0002-7882-7329"},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Matthew Roughan","raw_affiliation_strings":["University of Adelaide,Australia","University of Adelaide, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Adelaide,Australia","institution_ids":["https://openalex.org/I5681781"]},{"raw_affiliation_string":"University of Adelaide, Australia","institution_ids":["https://openalex.org/I5681781"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5017618655","display_name":"M. J. White","orcid":"https://orcid.org/0000-0001-5474-4580"},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Martin White","raw_affiliation_strings":["University of Adelaide,Australia","University of Adelaide, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Adelaide,Australia","institution_ids":["https://openalex.org/I5681781"]},{"raw_affiliation_string":"University of Adelaide, Australia","institution_ids":["https://openalex.org/I5681781"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5029686308","display_name":"Alexander Chambers","orcid":"https://orcid.org/0000-0001-5084-0153"},"institutions":[{"id":"https://openalex.org/I1303474014","display_name":"Defence Science and Technology Group","ror":"https://ror.org/05ddrvt52","country_code":"AU","type":"government","lineage":["https://openalex.org/I1303474014","https://openalex.org/I2801453606","https://openalex.org/I3139952251"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Alexander Chambers","raw_affiliation_strings":["Defence Science & Technology Group,Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Defence Science & Technology Group,Australia","institution_ids":["https://openalex.org/I1303474014"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.08635632,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"4"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.998199999332428,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9979000091552734,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8205121755599976},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.5486437082290649},{"id":"https://openalex.org/keywords/protocol","display_name":"Protocol (science)","score":0.521856427192688},{"id":"https://openalex.org/keywords/reverse-engineering","display_name":"Reverse engineering","score":0.4630254805088043},{"id":"https://openalex.org/keywords/distributed-computing","display_name":"Distributed computing","score":0.45967888832092285},{"id":"https://openalex.org/keywords/communications-protocol","display_name":"Communications protocol","score":0.45925113558769226},{"id":"https://openalex.org/keywords/osi-model","display_name":"OSI model","score":0.4462182819843292},{"id":"https://openalex.org/keywords/heuristic","display_name":"Heuristic","score":0.42115098237991333},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.4086035192012787},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.3937801718711853},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.32562610507011414},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.30561476945877075},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.1395062506198883}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8205121755599976},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.5486437082290649},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.521856427192688},{"id":"https://openalex.org/C207850805","wikidata":"https://www.wikidata.org/wiki/Q269608","display_name":"Reverse engineering","level":2,"score":0.4630254805088043},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.45967888832092285},{"id":"https://openalex.org/C12269588","wikidata":"https://www.wikidata.org/wiki/Q132364","display_name":"Communications protocol","level":2,"score":0.45925113558769226},{"id":"https://openalex.org/C168535184","wikidata":"https://www.wikidata.org/wiki/Q93312","display_name":"OSI model","level":3,"score":0.4462182819843292},{"id":"https://openalex.org/C173801870","wikidata":"https://www.wikidata.org/wiki/Q201413","display_name":"Heuristic","level":2,"score":0.42115098237991333},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.4086035192012787},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3937801718711853},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.32562610507011414},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.30561476945877075},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.1395062506198883},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.0},{"id":"https://openalex.org/C123745756","wikidata":"https://www.wikidata.org/wiki/Q1665949","display_name":"Interconnection","level":2,"score":0.0},{"id":"https://openalex.org/C142724271","wikidata":"https://www.wikidata.org/wiki/Q7208","display_name":"Pathology","level":1,"score":0.0},{"id":"https://openalex.org/C204787440","wikidata":"https://www.wikidata.org/wiki/Q188504","display_name":"Alternative medicine","level":2,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.23919/tma58422.2023.10198881","is_oa":false,"landing_page_url":"http://dx.doi.org/10.23919/tma58422.2023.10198881","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 7th Network Traffic Measurement and Analysis Conference (TMA)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":14,"referenced_works":["https://openalex.org/W1538375546","https://openalex.org/W2018506753","https://openalex.org/W2056325176","https://openalex.org/W2098824882","https://openalex.org/W2101234009","https://openalex.org/W2129208788","https://openalex.org/W2592742990","https://openalex.org/W2903489318","https://openalex.org/W2927810974","https://openalex.org/W3093727338","https://openalex.org/W3138456218","https://openalex.org/W4309226849","https://openalex.org/W6632460521","https://openalex.org/W6675354045"],"related_works":["https://openalex.org/W2792204436","https://openalex.org/W2520941344","https://openalex.org/W3021937834","https://openalex.org/W2047759090","https://openalex.org/W2020238430","https://openalex.org/W1972672554","https://openalex.org/W2397298427","https://openalex.org/W95850007","https://openalex.org/W1966753434","https://openalex.org/W1976929624"],"abstract_inverted_index":{"Information":[0],"and":[1,54,111,114],"communications":[2],"technology":[3],"(ICT)":[4],"systems":[5,16,33],"exchange":[6],"data":[7],"through":[8,20],"agreed":[9],"network":[10,18],"protocols.":[11,154],"These":[12],"constrain":[13],"how":[14],"ICT":[15],"send":[17],"packets":[19],"a":[21,81,139,150,174,194,209],"protocol":[22,48,74,77,125,137],"specification.":[23],"Protocol":[24],"specifications":[25,49,68],"are":[26,50,58],"useful":[27],"knowledge":[28],"for":[29,39,88,212],"building":[30],"intrusion":[31],"detection":[32],"to":[34,43,65,83,117,164,197],"monitor":[35],"system":[36,45],"behaviour,":[37],"or":[38],"performing":[40],"penetration":[41],"testing":[42],"find":[44],"vulnerabilities.":[46],"However,":[47],"typically":[51],"verbose":[52],"documents,":[53],"when":[55],"new":[56],"protocols":[57],"tested,":[59],"considerable":[60],"manual":[61],"effort":[62],"is":[63,80,156,171,193],"required":[64],"translate":[66],"these":[67],"into":[69],"digital":[70,86],"models":[71,87],"of":[72,109,120,134,147,152,159,177,182,215],"expected":[73],"behaviour.":[75],"Automated":[76],"reverse-engineering":[78],"(APRE)":[79],"precursor":[82],"generating":[84],"such":[85],"the":[89,97,102,107,121,130,180,188,207],"aforementioned":[90],"applications.":[91],"In":[92],"this":[93,170,202],"paper,":[94],"we":[95,204],"introduce":[96],"Packet":[98],"Field":[99],"Tree":[100],"(PFT),":[101],"first":[103],"hybrid":[104],"approach":[105],"combining":[106],"advantages":[108],"heuristic":[110],"supervised-learning":[112],"methods,":[113],"apply":[115],"it":[116],"one":[118],"aspect":[119],"APRE":[122,167,216],"problem":[123],"concerning":[124],"formats.":[126],"Our":[127],"model":[128],"infers":[129,187],"boundaries":[131],"between":[132],"fields":[133],"an":[135,143,157],"unknown":[136],"with":[138],"superior":[140],"mean":[141],"perfection,":[142],"APRE-specific":[144],"quasi-accuracy":[145],"measure,":[146],"0.27":[148],"over":[149],"variety":[151],"21":[153],"This":[155],"improvement":[158],"at":[160],"least":[161],"0.11":[162],"compared":[163],"three":[165],"existing":[166],"models.":[168],"Although":[169],"far":[172],"from":[173],"perfect":[175],"score":[176],"1.00,":[178],"highlighting":[179],"difficulty":[181],"APRE,":[183],"our":[184,198],"PFT":[185],"also":[186,205],"field":[189],"syntax":[190],"types,":[191],"which":[192],"feature":[195],"unique":[196],"model.":[199],"To":[200],"measure":[201],"feature,":[203],"propose":[206],"PFT-Score,":[208],"starting":[210],"point":[211],"holistic":[213],"evaluation":[214],"outputs.":[217]},"counts_by_year":[],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}