File(s) under permanent embargo
A positional keyword-based approach to inferring fine-grained message formats
Version 2 2024-06-06, 07:03Version 2 2024-06-06, 07:03
Version 1 2019-09-05, 08:39Version 1 2019-09-05, 08:39
journal contribution
posted on 2024-06-06, 07:03 authored by J Jiang, S Versteeg, J Han, MDA Hossain, Jean-Guy SchneiderJean-Guy Schneider© 2019 Elsevier B.V. Message format extraction, the process of revealing the message syntax without access to the protocol specification, is important for a variety of applications such as service virtualization and network security. In this paper, we propose P-token, which mines fine-grained message formats from network traces. The novelty of our approach is twofold: a ‘positional keyword’ identification technique and a two-level hierarchical clustering strategy. Positional keywords are based on the insight that keywords or reserved words usually occur at relatively fixed positions in the messages. By associating positions as meta-information with keywords, we can more accurately distinguish keywords from message payload data. After identification, the positional keywords are used as features to cluster the messages using density peaks clustering. We then perform another level of clustering to refine the clusters with low homogeneity. Finally, the message format of each cluster is extracted based on the observed ordering of keywords. P-token improves on the current state-of-the-art techniques by successfully addressing two challenges that commonly afflict existing keyword based format extraction methods: message keyword mis-identification and message format over-generalization. We have conducted experiments on services and applications using various protocols, including SOAP, LDAP, IMS and a RESTful service. Our experimental results show that P-token outperforms existing methods in extracting message formats.
History
Journal
Future Generation Computer SystemsVolume
102Pagination
369-381Location
Amsterdam, The NetherlandsPublisher DOI
ISSN
0167-739XeISSN
1872-7115Language
EnglishPublication classification
C1 Refereed article in a scholarly journalCopyright notice
2019, Elsevier B.V.Publisher
ELSEVIERUsage metrics
Categories
Keywords
Licence
Exports
RefWorksRefWorks
BibTeXBibTeX
Ref. managerRef. manager
EndnoteEndnote
DataCiteDataCite
NLMNLM
DCDC