# BinaryInferno: A Semantic-Driven Approach to Field Inference for Binary Message Formats
> Infers partial binary-message formats from static message samples without instrumenting an executable. Specialized detectors recognize floats, timestamps, lengths, entropy boundaries and serialization patterns; a graph-based integration step reconciles their descriptions. Across samples from ten protocols, the authors report top-level field-boundary precision of 0.69, recall of 0.73 and false-positive rate of 0.04 for the 1,000-message setting without analyst priors.
- Authors: Jared Chandler; Adam Wick; Kathleen Fisher
- Venue: NDSS 2023
- Status: Conference paper
- Publication / posting date: 2023 (exact date not verified)
- Date source: The official NDSS paper and publisher-deposited Crossref metadata establish publication year 2023. Crossref supplies no publication month or day; the conference dates and DOI registration date are not substituted.
- DOI: 10.14722/ndss.2023.23131
- Sources reviewed: 2026-10-17
- Added to the catalog: 2026-10-17
- Original paper:
- PDF:
- Code:
- BibTeX:
- Catalog page:
- Record JSON:
- Chinese version: [简体中文](https://awesomerea.org/zh/papers/paper-binaryinferno/index.md)
## Scope and limitations
Assumes error-free, uncompressed, unencrypted, byte-aligned data and infers common fields or payload regions beginning at consistent offsets. It leaves optional/union fields and unsupported serialization patterns unresolved; sample diversity matters. The 26 encapsulated-payload test sets were pre-grouped using ground-truth message types, not discovered automatically. Ground truth merges adjacent fields that are constant across the sample; empty inference results are excluded from reported averages where stated. BI+ additionally uses supplied endianness and capture-time ranges. These are field-boundary results, not complete semantic recovery, protocol-state inference or behavioral equivalence.
## Why it fits this collection
Provides trace-only semantic field inference that complements executable-assisted analysis and protocol-state learning, with explicit assumptions and evaluated false-positive behavior.
## Publication and review notes
Three-author order, title and DOI agree across the publisher, paper and Crossref. No arXiv identifier or proceedings page range was verified; the PDF has 18 pages. The paper’s project URL leads to the author’s Tufts page, which links the repository. The reviewed 2023-05-02 snapshot has GPL-3.0-or-later code headers and a GPLv3 LICENSE; third-party trace provenance and rights require separate checking. README prerequisites are Python 3, sklearn, scipy and parallel, without pinned dependency versions; the pattern-search launcher also uses timeout and hardcodes 30 parallel jobs. Input is one hexadecimal message per line; timestamp search accepts a supplied time range. The actual entry file is binaryinferno/blackboard.py, despite the README’s basic-command blackboard.by typo. A dataset directory is present, but its README remains a placeholder.
## Primary sources
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
## About this entry
Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.