The Experts below are selected from a list of 150 Experts worldwide ranked by ideXlab platform

Yipeng Wang - One of the best experts on this subject based on the ideXlab platform.

  • ICNP - A semantics aware approach to automated reverse engineering unknown Protocols
    2012 20th IEEE International Conference on Network Protocols (ICNP), 2012
    Co-Authors: Yipeng Wang, M. Zubair Shafiq, Liyan Wang, Zhibin Zhang, Yongzheng Zhang
    Abstract:

    Extracting the Protocol message format specifications of unknown applications from network traces is important for a variety of applications such as application Protocol parsing, vulnerability discovery, and system integration. In this paper, we propose ProDecoder, a network trace based Protocol message format inference system that exploits the semantics of Protocol messages without the executable code of application Protocols. ProDecoder is based on the key insight that the n-grams of Protocol traces exhibit highly skewed frequency distribution that can be leveraged for accurate Protocol message format inference. In ProDecoder, we first discover the latent relationship among n-grams by first grouping Protocol messages with the same semantics and then inferring message formats by keyword based clustering and cluster sequence alignment. We implemented and evaluated ProDecoder to infer message format specifications of SMB (a Binary Protocol) and SMTP (a textual Protocol). Our experimental results show that ProDecoder accurately parses and infers SMB Protocol with 100% precision and recall. For SMTP, ProDecoder achieves approximately 95% precision and recall.

  • A semantics aware approach to automated reverse engineering unknown Protocols
    2012 20th IEEE International Conference on Network Protocols (ICNP), 2012
    Co-Authors: Yipeng Wang, Zubair M Shafiq, Liyan Wang, Zhibin Zhang, Yongzheng Zhang
    Abstract:

    Extracting the Protocol message format specifications of unknown applications from network traces is important for a variety of applications such as application Protocol parsing, vulnerability discovery, and system integration. In this paper, we propose ProDecoder, a network trace based Protocol message format inference system that exploits the semantics of Protocol messages without the executable code of application Protocols. ProDecoder is based on the key insight that the n-grams of Protocol traces exhibit highly skewed frequency distribution that can be leveraged for accurate Protocol message format inference. In ProDecoder, we first discover the latent relationship among n-grams by first grouping Protocol messages with the same semantics and then inferring message formats by keyword based clustering and cluster sequence alignment. We implemented and evaluated ProDecoder to infer message format specifications of SMB (a Binary Protocol) and SMTP (a textual Protocol). Our experimental results show that ProDecoder accurately parses and infers SMB Protocol with 100% precision and recall. For SMTP, ProDecoder achieves approximately 95% precision and recall.

  • Biprominer: Automatic mining of Binary Protocol features
    Parallel and Distributed Computing, Applications and Technologies, PDCAT Proceedings, 2011
    Co-Authors: Yipeng Wang, Jiao Meng, Zhibin Zhang, Xin Li, Yong Zhao, Li Xi-guo
    Abstract:

    Application-level Protocol specifications are helpful for network security management, including intrusion detection and intrusion prevention which rely on monitoring technologies such as deep packet inspection. Moreover, detailed knowledge of Protocol specifications is also an effective way of detecting malicious code. However, current methods for obtaining unknown and proprietary Protocol message formats (i.e., no publicly available Protocol specification), especially Binary Protocols, highly rely on manual operations, such as reverse engineering which is time-consuming and laborious. In this paper, we propose Biprominer, a tool that can automatically extract Binary Protocol message formats of an application from its real-world network trace. In addition, we present a transition probability model for a better description of the Protocol. The chief feature of Biprominer is that it does not need to have any priori knowledge of Protocol formats, because Biprominer is based on the statistical nature of the Protocol format. We evaluate the efficacy of Biprominer over three Binary Protocols, with an average precision more than 99% and a recall better than 96.7%.

  • PDCAT - Biprominer: Automatic Mining of Binary Protocol Features
    2011 12th International Conference on Parallel and Distributed Computing Applications and Technologies, 2011
    Co-Authors: Yipeng Wang, Jiao Meng, Zhibin Zhang, Yong Zhao, Li Xi-guo
    Abstract:

    Application-level Protocol specifications are helpful for network security management, including intrusion detection and intrusion prevention which rely on monitoring technologies such as deep packet inspection. Moreover, detailed knowledge of Protocol specifications is also an effective way of detecting malicious code. However, current methods for obtaining unknown and proprietary Protocol message formats (i.e., no publicly available Protocol specification), especially Binary Protocols, highly rely on manual operations, such as reverse engineering which is time-consuming and laborious. In this paper, we propose Biprominer, a tool that can automatically extract Binary Protocol message formats of an application from its real-world network trace. In addition, we present a transition probability model for a better description of the Protocol. The chief feature of Biprominer is that it does not need to have any priori knowledge of Protocol formats, because Biprominer is based on the statistical nature of the Protocol format. We evaluate the efficacy of Biprominer over three Binary Protocols, with an average precision more than 99% and a recall better than 96.7%.

Yongzheng Zhang - One of the best experts on this subject based on the ideXlab platform.

  • ICNP - A semantics aware approach to automated reverse engineering unknown Protocols
    2012 20th IEEE International Conference on Network Protocols (ICNP), 2012
    Co-Authors: Yipeng Wang, M. Zubair Shafiq, Liyan Wang, Zhibin Zhang, Yongzheng Zhang
    Abstract:

    Extracting the Protocol message format specifications of unknown applications from network traces is important for a variety of applications such as application Protocol parsing, vulnerability discovery, and system integration. In this paper, we propose ProDecoder, a network trace based Protocol message format inference system that exploits the semantics of Protocol messages without the executable code of application Protocols. ProDecoder is based on the key insight that the n-grams of Protocol traces exhibit highly skewed frequency distribution that can be leveraged for accurate Protocol message format inference. In ProDecoder, we first discover the latent relationship among n-grams by first grouping Protocol messages with the same semantics and then inferring message formats by keyword based clustering and cluster sequence alignment. We implemented and evaluated ProDecoder to infer message format specifications of SMB (a Binary Protocol) and SMTP (a textual Protocol). Our experimental results show that ProDecoder accurately parses and infers SMB Protocol with 100% precision and recall. For SMTP, ProDecoder achieves approximately 95% precision and recall.

  • A semantics aware approach to automated reverse engineering unknown Protocols
    2012 20th IEEE International Conference on Network Protocols (ICNP), 2012
    Co-Authors: Yipeng Wang, Zubair M Shafiq, Liyan Wang, Zhibin Zhang, Yongzheng Zhang
    Abstract:

    Extracting the Protocol message format specifications of unknown applications from network traces is important for a variety of applications such as application Protocol parsing, vulnerability discovery, and system integration. In this paper, we propose ProDecoder, a network trace based Protocol message format inference system that exploits the semantics of Protocol messages without the executable code of application Protocols. ProDecoder is based on the key insight that the n-grams of Protocol traces exhibit highly skewed frequency distribution that can be leveraged for accurate Protocol message format inference. In ProDecoder, we first discover the latent relationship among n-grams by first grouping Protocol messages with the same semantics and then inferring message formats by keyword based clustering and cluster sequence alignment. We implemented and evaluated ProDecoder to infer message format specifications of SMB (a Binary Protocol) and SMTP (a textual Protocol). Our experimental results show that ProDecoder accurately parses and infers SMB Protocol with 100% precision and recall. For SMTP, ProDecoder achieves approximately 95% precision and recall.

Florian Palm - One of the best experts on this subject based on the ideXlab platform.

  • restful industrial communication with opc ua
    IEEE Transactions on Industrial Informatics, 2016
    Co-Authors: Sten Grüner, Julius Pfrommer, Florian Palm
    Abstract:

    Representational state transfer (REST) is a wide-spread architecture style for decentralized applications. REST proposes the use of a fixed set of service interfaces to transfer heterogeneous resource representations instead of defining custom interfaces for individual applications. This paper explores the advantages of RESTful architectures, i.e., service-oriented software architectures comprised RESTful services, in industrial settings. These include communication advantages such as reduced communication overhead and the possibility to introduce caching layers, and system design advantages including stable service interfaces across applications and the use of resource-oriented information models in cyber–physical systems. Additionally, a RESTful extension to the open platform communications (OPC) unified architecture (OPC UA) Binary Protocol is proposed in order to leverage these advantages. It requires only minimal modifications to the existing OPC UA stacks and is fully backward compatible with the standard Protocol. Performance benchmarks on industrial hardware show a throughput increase up to a factor of eight for short-lived interactions. This reduction of overhead is especially relevant for the use of OPC UA in the emerging Industrial Internet of Things.

  • WFCS - Hybrid OPC UA and DDS: Combining architectural styles for the industrial internet
    2016 IEEE World Conference on Factory Communication Systems (WFCS), 2016
    Co-Authors: Julius Pfrommer, Sten Grüner, Florian Palm
    Abstract:

    OPC UA and DDS are communication Protocols for the Industrial Internet. However, they make use of contrasting communication patterns and represent different architectural styles. We discuss these differences and their impact in an Industrial Internet and Internet of Things context. Further, we show up the possibilities for hybrid implementations leveraging the features of both OPC UA and DDS. For this, we provide a) a mapping of the OPC UA data types into DDS and b) a set of DDS quality of service policies that match the guarantees made by the standard OPC UA Binary Protocol.

  • WFCS - A RESTful extension of OPC UA
    2015 IEEE World Conference on Factory Communication Systems (WFCS), 2015
    Co-Authors: Sten Grüner, Julius Pfrommer, Florian Palm
    Abstract:

    RESTful interfaces are a wide-spread architecture style for webservice implementations and are built upon the resource-oriented approach to decentralized architectures (ROA). REST postulates a set of requirements that are not covered by the OPC Unified Architecture (OPC UA) communication Protocol per se. We propose a set of simple extensions to the OPC UA Binary Protocol that enable RESTful communication. The evaluation shows an order of magnitude improvement in the use of communication resources for sporadic service requests. Additionally, RESTful OPC UA allows applications to profit from the advantages of the resource-oriented architecture style, such as caching and loose application coupling.

Zhibin Zhang - One of the best experts on this subject based on the ideXlab platform.

  • ICNP - A semantics aware approach to automated reverse engineering unknown Protocols
    2012 20th IEEE International Conference on Network Protocols (ICNP), 2012
    Co-Authors: Yipeng Wang, M. Zubair Shafiq, Liyan Wang, Zhibin Zhang, Yongzheng Zhang
    Abstract:

    Extracting the Protocol message format specifications of unknown applications from network traces is important for a variety of applications such as application Protocol parsing, vulnerability discovery, and system integration. In this paper, we propose ProDecoder, a network trace based Protocol message format inference system that exploits the semantics of Protocol messages without the executable code of application Protocols. ProDecoder is based on the key insight that the n-grams of Protocol traces exhibit highly skewed frequency distribution that can be leveraged for accurate Protocol message format inference. In ProDecoder, we first discover the latent relationship among n-grams by first grouping Protocol messages with the same semantics and then inferring message formats by keyword based clustering and cluster sequence alignment. We implemented and evaluated ProDecoder to infer message format specifications of SMB (a Binary Protocol) and SMTP (a textual Protocol). Our experimental results show that ProDecoder accurately parses and infers SMB Protocol with 100% precision and recall. For SMTP, ProDecoder achieves approximately 95% precision and recall.

  • A semantics aware approach to automated reverse engineering unknown Protocols
    2012 20th IEEE International Conference on Network Protocols (ICNP), 2012
    Co-Authors: Yipeng Wang, Zubair M Shafiq, Liyan Wang, Zhibin Zhang, Yongzheng Zhang
    Abstract:

    Extracting the Protocol message format specifications of unknown applications from network traces is important for a variety of applications such as application Protocol parsing, vulnerability discovery, and system integration. In this paper, we propose ProDecoder, a network trace based Protocol message format inference system that exploits the semantics of Protocol messages without the executable code of application Protocols. ProDecoder is based on the key insight that the n-grams of Protocol traces exhibit highly skewed frequency distribution that can be leveraged for accurate Protocol message format inference. In ProDecoder, we first discover the latent relationship among n-grams by first grouping Protocol messages with the same semantics and then inferring message formats by keyword based clustering and cluster sequence alignment. We implemented and evaluated ProDecoder to infer message format specifications of SMB (a Binary Protocol) and SMTP (a textual Protocol). Our experimental results show that ProDecoder accurately parses and infers SMB Protocol with 100% precision and recall. For SMTP, ProDecoder achieves approximately 95% precision and recall.

  • Biprominer: Automatic mining of Binary Protocol features
    Parallel and Distributed Computing, Applications and Technologies, PDCAT Proceedings, 2011
    Co-Authors: Yipeng Wang, Jiao Meng, Zhibin Zhang, Xin Li, Yong Zhao, Li Xi-guo
    Abstract:

    Application-level Protocol specifications are helpful for network security management, including intrusion detection and intrusion prevention which rely on monitoring technologies such as deep packet inspection. Moreover, detailed knowledge of Protocol specifications is also an effective way of detecting malicious code. However, current methods for obtaining unknown and proprietary Protocol message formats (i.e., no publicly available Protocol specification), especially Binary Protocols, highly rely on manual operations, such as reverse engineering which is time-consuming and laborious. In this paper, we propose Biprominer, a tool that can automatically extract Binary Protocol message formats of an application from its real-world network trace. In addition, we present a transition probability model for a better description of the Protocol. The chief feature of Biprominer is that it does not need to have any priori knowledge of Protocol formats, because Biprominer is based on the statistical nature of the Protocol format. We evaluate the efficacy of Biprominer over three Binary Protocols, with an average precision more than 99% and a recall better than 96.7%.

  • PDCAT - Biprominer: Automatic Mining of Binary Protocol Features
    2011 12th International Conference on Parallel and Distributed Computing Applications and Technologies, 2011
    Co-Authors: Yipeng Wang, Jiao Meng, Zhibin Zhang, Yong Zhao, Li Xi-guo
    Abstract:

    Application-level Protocol specifications are helpful for network security management, including intrusion detection and intrusion prevention which rely on monitoring technologies such as deep packet inspection. Moreover, detailed knowledge of Protocol specifications is also an effective way of detecting malicious code. However, current methods for obtaining unknown and proprietary Protocol message formats (i.e., no publicly available Protocol specification), especially Binary Protocols, highly rely on manual operations, such as reverse engineering which is time-consuming and laborious. In this paper, we propose Biprominer, a tool that can automatically extract Binary Protocol message formats of an application from its real-world network trace. In addition, we present a transition probability model for a better description of the Protocol. The chief feature of Biprominer is that it does not need to have any priori knowledge of Protocol formats, because Biprominer is based on the statistical nature of the Protocol format. We evaluate the efficacy of Biprominer over three Binary Protocols, with an average precision more than 99% and a recall better than 96.7%.

Sten Grüner - One of the best experts on this subject based on the ideXlab platform.

  • restful industrial communication with opc ua
    IEEE Transactions on Industrial Informatics, 2016
    Co-Authors: Sten Grüner, Julius Pfrommer, Florian Palm
    Abstract:

    Representational state transfer (REST) is a wide-spread architecture style for decentralized applications. REST proposes the use of a fixed set of service interfaces to transfer heterogeneous resource representations instead of defining custom interfaces for individual applications. This paper explores the advantages of RESTful architectures, i.e., service-oriented software architectures comprised RESTful services, in industrial settings. These include communication advantages such as reduced communication overhead and the possibility to introduce caching layers, and system design advantages including stable service interfaces across applications and the use of resource-oriented information models in cyber–physical systems. Additionally, a RESTful extension to the open platform communications (OPC) unified architecture (OPC UA) Binary Protocol is proposed in order to leverage these advantages. It requires only minimal modifications to the existing OPC UA stacks and is fully backward compatible with the standard Protocol. Performance benchmarks on industrial hardware show a throughput increase up to a factor of eight for short-lived interactions. This reduction of overhead is especially relevant for the use of OPC UA in the emerging Industrial Internet of Things.

  • WFCS - Hybrid OPC UA and DDS: Combining architectural styles for the industrial internet
    2016 IEEE World Conference on Factory Communication Systems (WFCS), 2016
    Co-Authors: Julius Pfrommer, Sten Grüner, Florian Palm
    Abstract:

    OPC UA and DDS are communication Protocols for the Industrial Internet. However, they make use of contrasting communication patterns and represent different architectural styles. We discuss these differences and their impact in an Industrial Internet and Internet of Things context. Further, we show up the possibilities for hybrid implementations leveraging the features of both OPC UA and DDS. For this, we provide a) a mapping of the OPC UA data types into DDS and b) a set of DDS quality of service policies that match the guarantees made by the standard OPC UA Binary Protocol.

  • WFCS - A RESTful extension of OPC UA
    2015 IEEE World Conference on Factory Communication Systems (WFCS), 2015
    Co-Authors: Sten Grüner, Julius Pfrommer, Florian Palm
    Abstract:

    RESTful interfaces are a wide-spread architecture style for webservice implementations and are built upon the resource-oriented approach to decentralized architectures (ROA). REST postulates a set of requirements that are not covered by the OPC Unified Architecture (OPC UA) communication Protocol per se. We propose a set of simple extensions to the OPC UA Binary Protocol that enable RESTful communication. The evaluation shows an order of magnitude improvement in the use of communication resources for sporadic service requests. Additionally, RESTful OPC UA allows applications to profit from the advantages of the resource-oriented architecture style, such as caching and loose application coupling.