# DynPRE: Protocol Reverse Engineering via Dynamic Inference > DynPRE starts from captured client–server traces and then interacts with a live protocol server to infer message formats and types. It detects session-specific identifiers such as cookies and rewrites them on the fly so that replayed requests stay valid. It then sends byte-level probe requests whose responses serve as semantic feedback for field identification, aligns the responses, and applies a request–response mapping refinement that also recognizes message types. On 12 protocols with 10-, 100- and 1,000-message datasets, the authors report average field perfection of 0.50 and message-type V-measure of 0.94, against 0.15–0.31 perfection for Netzob, NetPlier, FieldHunter, BinaryInferno and NEMESYS. - Authors: Zhengxiong Luo; Kai Liang; Yanyang Zhao; Feifan Wu; Junze Yu; Heyuan Shi; Yu Jiang - Venue: NDSS 2024 - Status: Conference paper - Publication / posting date: 2024 (exact date not verified) - Date source: Internet Society-deposited Crossref metadata supplies only publication year 2024; the publisher PDF separately identifies the 26 February–1 March 2024 symposium, which is not used to assert a publication month or day. - DOI: 10.14722/ndss.2024.24083 - Sources reviewed: 2026-10-18 - Added to the catalog: 2026-10-19 - Original paper: - PDF: - BibTeX: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/papers/paper-dynpre/index.md) ## Scope and limitations The method needs captured traces plus a reachable server that it can query repeatedly; it does not work from passive captures alone. Probing changes server state: each probe opens a new session, but protocols with global state, such as IoT device power state, can still degrade feedback. On the 1,000-message datasets an analysis averaged 259 minutes, 50,344 connection attempts and about 3.98 million exchanged messages, so slow or rate-limiting servers reduce efficiency. Encryption and authentication were disabled in the open-source evaluation setups, and encrypted traffic in the IoT case studies was decrypted with device private keys. Checksummed protocols need an added checksum-reversal step, shown only on ICMP. Format ground truth comes from tshark dissectors, and message types from manual reading of protocol documents. The five-device IoT case studies test whether generated messages trigger device behaviors, not whether specifications are complete. State-machine inference reuses existing methods and is not evaluated as a contribution. ## Why it fits this collection Adds active, server-interactive protocol inference, complementing the trace-only, binary-assisted and source-based protocol reconstruction research in this section. ## Publication and review notes The NDSS paper page lists the seven authors with affiliations and links the PDF and slides; Crossref gives the same author order and only the year 2024. The PDF footer gives the 26 February–1 March 2024 symposium in San Diego, ISBN 1-891562-93-2 and the DOI. No arXiv version was found. The paper says DynPRE is available at github.com/DynPRE/DynPRE, but the 2025-08-27 snapshot contains only a README asking readers to contact the authors by email for the code and declares no license. The paper ran the baselines from public releases, using a public re-implementation for FieldHunter. ## Primary sources 1. 2. 3. 4. 5. ## About this entry Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.