L. Maile, “Processes for Network Protocol Analyses,” Bachelor's thesis, S. Kleber (Supervisor), F. Kargl (Examiner), Inst. of Distr. Sys., Ulm Univ., 2016 – Completed
For every communication between two or more participants in distributed systems or networks, protocols are needed in order to agree upon the way the communication messages are interpreted. Unfortunately, many protocols are unknown to the public because of missing or unavailable specifications. To understand the functionality of these protocols and, eventually, their message content, these unknown protocols need to be reversed engineered. At present, network protocol reverse engineering is performed mostly manually with the expertise and intuition of the engineer, insofar as there are no completely automated methods yet. If analyzed by hand, the most difficulties are faced when comparing protocols with variable field lengths, since the protocol’s structure is blurred and patterns cannot be detected easily. Furthermore, complex state machines are hardly manageable without the support of automated tools. The value gained from protocol analyses research ranges from general understanding of the protocol to security issues, such as the creation of specific firewall rules or by helping intrusion detection systems to identify the behavior of malware. This bachelor thesis analyzes static protocol analyses and describes every stage passed from capturing unknown protocols to the deduction of protocol message formats and the state machine. It thereby presents currently existing automatic approaches for each stage and the benefits compared to a purely manual task. Finally, it evaluates the current processes, emphasizes limitations and proposes improvement suggestions for the future.