2021 · Conference paper
NetPlier: Probabilistic Network Protocol Reverse Engineering from Message Traces
Uses multiple sequence alignment and probabilistic keyword-field inference to cluster network messages by type, evaluated across ten protocols with downstream format and state-machine analysis.
Scope and limitations
Requires unencrypted traces and cannot recover unseen message types. Larger alignments, sub-byte keywords and one-way traffic can reduce accuracy. Format/FSM inference is downstream evaluation rather than the main contribution; state semantics in a case study were manually annotated. These models do not establish complete application/device reconstruction.
Why it fits this collection
Connects observed application/device traffic to message-type models needed for protocol reconstruction.
Publication and review details
- Venue
- NDSS 2021
- Status
- Conference paper
- Publication / posting date
- 2021 (exact date not verified)
- Date source
- Publisher-deposited Crossref metadata supplies publication year 2021; the publisher PDF separately identifies the 21–25 February 2021 symposium.
- DOI
- 10.14722/ndss.2021.24531
The publisher paper cites netplier-tool/NetPlier, which now redirects to yapengye/NetPlier. The pinned GPLv3 artifact implements keyword inference and clustering evaluation; its core retains TODOs for iteration and format inference.
Sources reviewed
Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX.
Discussed in the survey
Primary sources
- https://www.ndss-symposium.org/ndss-paper/netplier-probabilistic-network-protocol-reverse-engineering-from-message-traces/
- https://www.ndss-symposium.org/wp-content/uploads/ndss2021_4A-5_24531_paper.pdf
- https://api.crossref.org/works/10.14722/ndss.2021.24531
- README.md GitHub · yapengye/NetPlier · Revision 78abbe6
- netplier/netplier.py GitHub · yapengye/NetPlier · Revision 78abbe6
- LICENSE GitHub · yapengye/NetPlier · Revision 78abbe6