BitInfer: An Automated Field Semantic Inference Method Based on Genetic Algorithm

Private protocols are widely used on the network to improve efficiency and protect privacy. However, it lacks standard protocols to unify the communication process and improve security. Protocol Reverse Engineering (PRE) aims to infer the syntax, semantics, and timing of the unknown protocol. In detail, it always infers the field information and the state machine. Yet, the results of existing PRE methods focus byte-level, and the target setting is an empirical process. To overcome the shortage, we proposed BitInfer for binary protocols. BitInfer uses a set of field detectors, including Length Detector, Timestamp Detector, Entropy Detector, Sequence Detector and Reserve Detector to divide the protocols into bit-level field and get the confidence of them. Then we randomly choose the combination of detector tuples to get the init population by repeating the process for a specific times. Finally, we use NSGA2 as the intergrade algorithm to deal with the field conflict. Experiments show that the result of BitInfer precisely solve the conflict and extend to bit level.