<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-02023719</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-20T15:25:12+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">PRETT: Protocol Reverse Engineering Using Binary Tokens and Network Traces</title>
            <author role="aut">
              <persName>
                <forename type="first">Choongin</forename>
                <surname>Lee</surname>
              </persName>
              <email type="md5">6ef4d6a197785a5a01697c918c9e032a</email>
              <email type="domain">korea.ac.kr</email>
              <idno type="idhal" notation="numeric">1042885</idno>
              <idno type="halauthorid" notation="string">1525968-1042885</idno>
              <affiliation ref="#struct-466797"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Jeonghan</forename>
                <surname>Bae</surname>
              </persName>
              <email type="md5">21221b1c05f3af53db2b5ec2ec49a0e7</email>
              <email type="domain">korea.ac.kr</email>
              <idno type="idhal" notation="numeric">1042886</idno>
              <idno type="halauthorid" notation="string">1525969-1042886</idno>
              <affiliation ref="#struct-466797"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Heejo</forename>
                <surname>Lee</surname>
              </persName>
              <email type="md5">5e67f17256f934d3ed5d3dce770693a8</email>
              <email type="domain">korea.ac.kr</email>
              <idno type="idhal" notation="numeric">989242</idno>
              <idno type="halauthorid" notation="string">1060761-989242</idno>
              <affiliation ref="#struct-466797"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Hal</forename>
                <surname>Ifip</surname>
              </persName>
              <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
              <email type="domain">inria.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2019-02-21 15:09:25</date>
              <date type="whenModified">2019-02-21 15:16:06</date>
              <date type="whenReleased">2019-02-21 15:16:06</date>
              <date type="whenProduced">2018-09-18</date>
              <date type="whenEndEmbargoed">2021-01-01</date>
              <ref type="file" target="https://inria.hal.science/hal-02023719v1/document">
                <date notBefore="2021-01-01"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://inria.hal.science/hal-02023719v1/file/472722_1_En_11_Chapter.pdf" id="file-2044508-2051346">
                <date notBefore="2021-01-01"/>
              </ref>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="200187">
                <persName>
                  <forename>Hal</forename>
                  <surname>Ifip</surname>
                </persName>
                <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
                <email type="domain">inria.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-02023719</idno>
            <idno type="halUri">https://inria.hal.science/hal-02023719</idno>
            <idno type="halBibtex">lee:hal-02023719</idno>
            <idno type="halRefHtml">&lt;i&gt;33th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC)&lt;/i&gt;, Sep 2018, Poznan, Poland. pp.141-155, &lt;a target="_blank" href="https://dx.doi.org/10.1007/978-3-319-99828-2_11"&gt;&amp;#x27E8;10.1007/978-3-319-99828-2_11&amp;#x27E9;&lt;/a&gt;</idno>
            <idno type="halRef">33th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC), Sep 2018, Poznan, Poland. pp.141-155, &amp;#x27E8;10.1007/978-3-319-99828-2_11&amp;#x27E9;</idno>
            <availability status="restricted">
              <licence target="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0 - Attribution<ref corresp="#file-2044508-2051346"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="IFIP">IFIP - International Federation for Information Processing</idno>
            <idno type="stamp" n="IFIP-AICT" corresp="IFIP">IFIP Advances in Information and Communication Technology</idno>
            <idno type="stamp" n="IFIP-TC" corresp="IFIP">IFIP Technical Committees </idno>
            <idno type="stamp" n="IFIP-TC11" corresp="IFIP-TC">IFIP TC11: Security and Privacy Protection in Information Processing Systems</idno>
            <idno type="stamp" n="IFIP-SEC" corresp="IFIP"> International Information Security Conference</idno>
            <idno type="stamp" n="IFIP-AICT-529" corresp="IFIP-AICT">ICT Systems Security and Privacy Protection</idno>
          </seriesStmt>
          <notesStmt>
            <note type="commentary">Part 2: Failures of Security Management</note>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">PRETT: Protocol Reverse Engineering Using Binary Tokens and Network Traces</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Choongin</forename>
                    <surname>Lee</surname>
                  </persName>
                  <email type="md5">6ef4d6a197785a5a01697c918c9e032a</email>
                  <email type="domain">korea.ac.kr</email>
                  <idno type="idhal" notation="numeric">1042885</idno>
                  <idno type="halauthorid" notation="string">1525968-1042885</idno>
                  <affiliation ref="#struct-466797"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Jeonghan</forename>
                    <surname>Bae</surname>
                  </persName>
                  <email type="md5">21221b1c05f3af53db2b5ec2ec49a0e7</email>
                  <email type="domain">korea.ac.kr</email>
                  <idno type="idhal" notation="numeric">1042886</idno>
                  <idno type="halauthorid" notation="string">1525969-1042886</idno>
                  <affiliation ref="#struct-466797"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Heejo</forename>
                    <surname>Lee</surname>
                  </persName>
                  <email type="md5">5e67f17256f934d3ed5d3dce770693a8</email>
                  <email type="domain">korea.ac.kr</email>
                  <idno type="idhal" notation="numeric">989242</idno>
                  <idno type="halauthorid" notation="string">1060761-989242</idno>
                  <affiliation ref="#struct-466797"/>
                </author>
              </analytic>
              <monogr>
                <title level="m">IFIP Advances in Information and Communication Technology</title>
                <meeting>
                  <title>33th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC)</title>
                  <date type="start">2018-09-18</date>
                  <date type="end">2018-09-20</date>
                  <settlement>Poznan</settlement>
                  <country key="PL">Poland</country>
                </meeting>
                <editor>Lech Jan Janczewski</editor>
                <editor>Mirosław Kutyłowski</editor>
                <imprint>
                  <publisher>Springer International Publishing</publisher>
                  <biblScope unit="serie">ICT Systems Security and Privacy Protection</biblScope>
                  <biblScope unit="volume">AICT-529</biblScope>
                  <biblScope unit="pp">141-155</biblScope>
                  <date type="datePub">2018</date>
                </imprint>
              </monogr>
              <idno type="doi">10.1007/978-3-319-99828-2_11</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <keywords scheme="author">
                <term xml:lang="en">Automatic protocol analysis</term>
                <term xml:lang="en">State machine reconstruction</term>
                <term xml:lang="en">Protocol reverse engineering</term>
              </keywords>
              <classCode scheme="halDomain" n="info">Computer Science [cs]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>Protocol reverse engineering is the process of extracting application-level protocol specifications. The specifications are a useful source of knowledge about network protocols and can be used for various purposes. Despite the successful results of prior works, their methods primarily result in the inference of a limited number of message types. We herein propose a novel approach that infers a minimized state machine while having a rich amount of information. The combined input of tokens extracted from the network protocol binary executables and network traces enables the inference of new message types and protocol behaviors which had not been found in previous works. In addition, we propose a state minimization algorithm that can be applied to real-time black-box inference. The experimental results show that our approach can infer the largest number of message types for file-transfer protocol (FTP) and simple mail-transfer protocol (SMTP) compared to eight prior arts. Moreover, we found unexpected behaviors in two protocol implementations using the inferred state machines.</p>
            </abstract>
            <particDesc>
              <org type="consortium">TC 11</org>
            </particDesc>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="institution" xml:id="struct-466797" status="VALID">
          <idno type="ROR">https://ror.org/047dqcg40</idno>
          <orgName>Korea University [Seoul]</orgName>
          <date type="start">2016-09-27</date>
          <desc>
            <address>
              <addrLine>145 Anam-ro, Seongbuk-gu, Seoul, South Korea</addrLine>
              <country key="KR"/>
            </address>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>