2023 · Conference paper
Lifting Network Protocol Implementation to Precise Format Specification with Security Applications
NetLifter statically lifts source-available C protocol parsers into BNF-style message grammars and first-order constraints between packet fields. It analyzes annotated LLVM bitcode using abstract format graphs, localized path-sensitive analysis, unfolding and reordering. The resulting field boundaries, constraints and names can support packet generation and parser construction.
Scope and limitations
Requires source/LLVM IR and packet-buffer/length annotations; it is not closed-binary or traffic-only recovery. The paper targets common top-down C parsers and does not support C++, inline assembly or libraries without available code. Pointer/loop analysis remains approximate; checksum fields can be identified while some checksum constraints are omitted, and fields ignored by an implementation may be missed. Precision/recall was manually checked on ten selected protocols. The reported fuzzing evaluation used three-hour runs repeated twenty times and bypassed checksum checks. It infers formats, not protocol state machines or proof of implementation equivalence.
Why it fits this collection
Adds source-to-format inference with cross-field constraints, complementing traffic-based and binary-assisted protocol reconstruction research.
Publication and review details
- Venue
- ACM CCS 2023
- Status
- Conference paper
- Publication / posting date
- November 15, 2023
- Date source
- ACM’s Crossref deposit records published/print publication on 2023-11-15 and a separate online/publication-history date of 2023-11-21. This entry uses the published/print date, not the November 26–30 conference dates.
- First arXiv submission
- May 19, 2023
- arXiv
- 2305.11781
- Reviewed arXiv version
- v1
- DOI
- 10.1145/3576915.3616614
The final author PDF and Crossref establish the five-author order, CCS 2023 DOI and pages. The 19-page arXiv v1 retains an old CCS 2022 submission template and placeholder DOI; publication identity follows the final 15-page paper. The repository calls its prototype Popeye and warns of rough edges. Its reviewed 2025-04-21 snapshot declares AGPL-3.0-or-later in source headers. CMake requires 3.10+, LLVM 12.x and Z3>=4.8.12; README recommends LLVM 12.0.1 and the author’s modified Z3 4.8.12-popeye branch. Vectorized IR is unsupported: README documents -fno-vectorize and -fno-slp-vectorize, and recommends debug information and removal of optimization flags for field naming. Dependencies and target code retain separate terms.
Sources reviewed
Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX.
Discussed in the survey
Primary sources
- https://dl.acm.org/doi/10.1145/3576915.3616614
- https://api.crossref.org/works/10.1145/3576915.3616614
- https://qingkaishi.github.io/public_pdfs/CCS23.pdf
- https://arxiv.org/abs/2305.11781
- https://arxiv.org/pdf/2305.11781v1
- README.md GitHub · qingkaishi/netlifter · Revision 362fe1e
- LICENSE.txt GitHub · qingkaishi/netlifter · Revision 362fe1e
- CMakeLists.txt GitHub · qingkaishi/netlifter · Revision 362fe1e
- tools/popeye/popeye.cpp GitHub · qingkaishi/netlifter · Revision 362fe1e
- tools/popeye/LiftingPass.cpp GitHub · qingkaishi/netlifter · Revision 362fe1e
- benchmarks/popeye/readme.txt GitHub · qingkaishi/netlifter · Revision 362fe1e
- benchmarks/popeye/regression.sh GitHub · qingkaishi/netlifter · Revision 362fe1e
- README-CMake.md GitHub · qingkaishi/z3 · Revision b42b2d6
- LICENSE.txt GitHub · qingkaishi/z3 · Revision b42b2d6