Automatic protocol reverse engineering using grammatical inference.

For a thorough understanding of procedures in various network applications, and to automatically classify, recognize, trace, and control them, it is necessary that the state machine representing application sessions is obtained in advance. This article presents a novel approach to reversely infer a protocol state machine from collected data of the application layer. Protocol state machines are derived using a method of error-correcting grammatical inference, which is based on symbol sequences that appear in the application sessions. The techniques are implemented into a tool called PREUGI, which is conducted in a real network, containing a number of real applications with several application layer protocols, to validate the proposed method. [ABSTRACT FROM AUTHOR]