Fingerprinting Protocol at Bit-Level Granularity: A Graph-Based Approach Using Cell Embedding

Traffic identification is defined as the act of ascertaining which application or service or protocol is contributing to the network traffic by using a fingerprint, which is a distinguishable unique pattern representing a particular applications traffic. The continual appearance of new applications and their frequent updates emphasize the need for automatic protocol fingerprints generation. In this paper, we propose BitGrapher, a novel graph-based approach that accurately infers protocol fingerprints at bit-level granularity for accurate traffic identification. The proposal is designed to accommodate to various protocol traces including text-based and binary-based protocols, and even possible unknown proprietary communication protocols. Our proposed approach introduces a new concept of cell that allows BitGrapher to encode protocol payloads as a graphical model, and then converts fingerprinting protocol problem as a series of graph operations (e.g., graph construction, pruning, partition). The key insight of the graphical model use cell embeddings that captures the distinguishable positions with their values and distinguishable correlation among them. We implement and evaluate BitGrapher on real-world traces, including DNS, QQLive, SopCast, SMB, HTTP, and SMTP, and our experimental results show that BitGrapher can accurately identify the protocol trace with an average precision of about 97.28% and an average recall of about 99.12%. We also compare the results of BitGrapher to two state-of-the-art approaches ProWord and ProDigger, which shows that BitGrapher provides significant improvements in precision and recall for protocol identification task.