# NEMESYS: Network Message Syntax Reverse Engineering by Analysis of the Intrinsic Structure of Individual Messages

> Infers approximate field boundaries within individual binary-protocol messages from changes in bit congruence, and introduces Format Match Score to compare inferred segmentation with known protocol dissectors.

- Authors: Stephan Kleber; Henning Kopp; Frank Kargl
- Venue: 12th USENIX Workshop on Offensive Technologies (WOOT 18)
- Status: Conference paper
- Publication / posting date: August 2018
- Date source: The official USENIX BibTeX entry identifies August 2018 for the WOOT 18 workshop publication.
- Sources reviewed: 2026-10-16
- Added to the catalog: 2026-10-17
- Original paper: <https://www.usenix.org/conference/woot18/presentation/kleber>
- PDF: <https://www.usenix.org/system/files/conference/woot18/woot18-paper-kleber.pdf>
- Code: <https://github.com/vs-uulm/nemesys>
- BibTeX: <https://awesomerea.org/papers/citations/paper-nemesys.bib>
- Catalog page: <https://awesomerea.org/papers/paper-nemesys/>
- Record JSON: <https://awesomerea.org/papers/paper-nemesys/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/papers/paper-nemesys/index.md)

## Scope and limitations

Requires plaintext payloads. Evaluation covers DNS, DHCP and NTP with protocol-tuned parameters. Single-byte fields are not inferred; zero-filled fields, character sequences and pseudo-random values can cause errors. FMS needs known field boundaries for validation. The output is approximate segmentation, not field semantics, a state machine or complete application/device behavior.

## Why it fits this collection

Provides a foundational method for reconstructing wire-message structure from observed traffic.

## Publication and review notes

The official USENIX citation verifies this workshop paper; no DOI or arXiv identifier was verified. The linked author repository now integrates NEMESYS with later NEMETYL and 2022 methods. Its README identifies it as experimental and its LICENSE declares MIT.

## Primary sources

1. <https://www.usenix.org/conference/woot18/presentation/kleber>
2. <https://www.usenix.org/system/files/conference/woot18/woot18-paper-kleber.pdf>
3. <https://www.usenix.org/biblio/export/bibtex/220576>
4. <https://github.com/vs-uulm/nemesys/blob/e98da1d9baa5727d8f085823369c733416b66a21/README.md>
5. <https://github.com/vs-uulm/nemesys/blob/e98da1d9baa5727d8f085823369c733416b66a21/LICENSE>

## About this entry

Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.