# NetPlier: Probabilistic Network Protocol Reverse Engineering from Message Traces

> Uses multiple sequence alignment and probabilistic keyword-field inference to cluster network messages by type, evaluated across ten protocols with downstream format and state-machine analysis.

- Authors: Yapeng Ye; Zhuo Zhang; Fei Wang; Xiangyu Zhang; Dongyan Xu
- Venue: NDSS 2021
- Status: Conference paper
- Publication / posting date: 2021 (exact date not verified)
- Date source: Publisher-deposited Crossref metadata supplies publication year 2021; the publisher PDF separately identifies the 21–25 February 2021 symposium.
- DOI: 10.14722/ndss.2021.24531
- Sources reviewed: 2026-10-16
- Added to the catalog: 2026-10-17
- Original paper: <https://www.ndss-symposium.org/ndss-paper/netplier-probabilistic-network-protocol-reverse-engineering-from-message-traces/>
- PDF: <https://www.ndss-symposium.org/wp-content/uploads/ndss2021_4A-5_24531_paper.pdf>
- Code: <https://github.com/yapengye/NetPlier>
- BibTeX: <https://awesomerea.org/papers/citations/paper-netplier.bib>
- Catalog page: <https://awesomerea.org/papers/paper-netplier/>
- Record JSON: <https://awesomerea.org/papers/paper-netplier/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/papers/paper-netplier/index.md)

## Scope and limitations

Requires unencrypted traces and cannot recover unseen message types. Larger alignments, sub-byte keywords and one-way traffic can reduce accuracy. Format/FSM inference is downstream evaluation rather than the main contribution; state semantics in a case study were manually annotated. These models do not establish complete application/device reconstruction.

## Why it fits this collection

Connects observed application/device traffic to message-type models needed for protocol reconstruction.

## Publication and review notes

The publisher paper cites netplier-tool/NetPlier, which now redirects to yapengye/NetPlier. The pinned GPLv3 artifact implements keyword inference and clustering evaluation; its core retains TODOs for iteration and format inference.

## Primary sources

1. <https://www.ndss-symposium.org/ndss-paper/netplier-probabilistic-network-protocol-reverse-engineering-from-message-traces/>
2. <https://www.ndss-symposium.org/wp-content/uploads/ndss2021_4A-5_24531_paper.pdf>
3. <https://api.crossref.org/works/10.14722/ndss.2021.24531>
4. <https://github.com/yapengye/NetPlier/blob/78abbe67606c76fcd9bfec17667c662dce58f567/README.md>
5. <https://github.com/yapengye/NetPlier/blob/78abbe67606c76fcd9bfec17667c662dce58f567/netplier/netplier.py>
6. <https://github.com/yapengye/NetPlier/blob/78abbe67606c76fcd9bfec17667c662dce58f567/LICENSE>

## About this entry

Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.