figshare
Browse

File(s) under permanent embargo

A positional keyword-based approach to inferring fine-grained message formats

Version 2 2024-06-06, 07:03
Version 1 2019-09-05, 08:39
journal contribution
posted on 2024-06-06, 07:03 authored by J Jiang, S Versteeg, J Han, MDA Hossain, Jean-Guy SchneiderJean-Guy Schneider
© 2019 Elsevier B.V. Message format extraction, the process of revealing the message syntax without access to the protocol specification, is important for a variety of applications such as service virtualization and network security. In this paper, we propose P-token, which mines fine-grained message formats from network traces. The novelty of our approach is twofold: a ‘positional keyword’ identification technique and a two-level hierarchical clustering strategy. Positional keywords are based on the insight that keywords or reserved words usually occur at relatively fixed positions in the messages. By associating positions as meta-information with keywords, we can more accurately distinguish keywords from message payload data. After identification, the positional keywords are used as features to cluster the messages using density peaks clustering. We then perform another level of clustering to refine the clusters with low homogeneity. Finally, the message format of each cluster is extracted based on the observed ordering of keywords. P-token improves on the current state-of-the-art techniques by successfully addressing two challenges that commonly afflict existing keyword based format extraction methods: message keyword mis-identification and message format over-generalization. We have conducted experiments on services and applications using various protocols, including SOAP, LDAP, IMS and a RESTful service. Our experimental results show that P-token outperforms existing methods in extracting message formats.

History

Journal

Future Generation Computer Systems

Volume

102

Pagination

369-381

Location

Amsterdam, The Netherlands

ISSN

0167-739X

eISSN

1872-7115

Language

English

Publication classification

C1 Refereed article in a scholarly journal

Copyright notice

2019, Elsevier B.V.

Publisher

ELSEVIER