{
  "added_at": "2026-10-28",
  "arxiv_id": null,
  "arxiv_version_reviewed": null,
  "authors": [
    "Juan Caballero",
    "Heng Yin",
    "Zhenkai Liang",
    "Dawn Song"
  ],
  "bibtex_url": "https://awesomerea.org/papers/citations/paper-polyglot.bib",
  "code_url": null,
  "date_basis": "ACM’s Crossref deposit records both print and online publication on 2007-10-28. This entry uses that date, not the October 29–November 2 conference dates printed on the paper.",
  "date_basis_zh": "ACM 提交的 Crossref 元数据将纸质与在线出版日期均记为 2007-10-28。本条目采用该日期，而非论文所印 10 月 29 日至 11 月 2 日的会议日期。",
  "date_precision": "day",
  "description_en": "Polyglot infers the format of a message that a program receives by monitoring how the program binary processes it, an approach the authors call shadowing. An execution monitor taints network input and records an instruction trace; offline analyses then find direction fields, such as length and pointer fields, from tainted memory accesses and loop conditions, separators from comparisons between tainted bytes and constants, multi-byte fixed-length fields from how instructions group input bytes, and protocol keywords from successful comparisons. It works on stripped IA-32 binaries without source code or debugging information.",
  "description_zh": "Polyglot 通过监测程序二进制如何处理接收到的报文来推断其格式，作者称这一方法为“影随”（shadowing）。执行监控器对网络输入施加污点标记并记录指令轨迹；离线分析再依据受污点数据参与的内存访问与循环条件识别长度字段、指针字段等指向字段，依据受污点字节与常量之间的比较识别分隔符，依据指令如何组合输入字节识别多字节定长字段，并依据成功的比较提取协议关键字。该方法适用于剥离符号的 IA-32 二进制，无需源码或调试信息。",
  "doi": "10.1145/1315245.1315286",
  "entry_url": "https://awesomerea.org/papers/paper-polyglot/",
  "entry_url_zh": "https://awesomerea.org/zh/papers/paper-polyglot/",
  "evidence_urls": [
    "https://dl.acm.org/doi/10.1145/1315245.1315286",
    "https://api.crossref.org/works/10.1145/1315245.1315286",
    "https://people.eecs.berkeley.edu/~dawnsong/papers/2007%20p317-caballero.pdf",
    "https://www.cs.ucr.edu/~heng/pubs/polyglot-ccs07.pdf"
  ],
  "first_arxiv_date": null,
  "id": "paper-polyglot",
  "json_url": "https://awesomerea.org/papers/paper-polyglot/record.json",
  "kind": "research",
  "markdown_url": "https://awesomerea.org/papers/paper-polyglot/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/papers/paper-polyglot/index.md",
  "metadata_notes": "Crossref records the title as “Polyglot” with the lowercase subtitle “automatic extraction of protocol message format using dynamic binary analysis”, the four-author order and pages 317–329; this entry follows the capitalization printed on the paper. The 13-page ACM-formatted copy hosted on Dawn Song’s Berkeley site carries the CCS’07 copyright notice and page numbers from 317. A 15-page author version with appendices is hosted at UC Riverside and says the definitive version was published at CCS’07. The execution monitor is cited as the authors’ earlier work and is not released with the paper. The paper gives no code or project link, so both stay null.",
  "metadata_notes_zh": "Crossref 将标题记为“Polyglot”，副标题为小写的“automatic extraction of protocol message format using dynamic binary analysis”，并记录四位作者顺序及页码 317–329；本条目采用论文所印的大小写。托管在 Dawn Song 伯克利网站上的 13 页 ACM 排版副本载有 CCS’07 版权声明，页码从 317 起。加州大学河滨分校托管有一份含附录的 15 页作者版本，注明正式版本发表于 CCS’07。执行监控器引自作者此前的工作，并未随论文发布。论文未提供代码或项目链接，因此两者均为 null。",
  "pdf_url": "https://dl.acm.org/doi/pdf/10.1145/1315245.1315286",
  "project_url": null,
  "publication_date": "2007-10-28",
  "publication_status": "conference-paper",
  "record_type": "paper",
  "runtime_tested": false,
  "scope_limitations_en": "It extracts the format of one received message at a time and only of messages given to the analysis; messages that never appear stay unknown, and messages the program sends are not analyzed. It does not infer the protocol state machine. The evaluation covers eleven 2007-era programs implementing DNS, HTTP, IRC, ICQ and Samba, mostly Windows servers plus an ICQ client and a Linux Samba server, with one representative message per protocol, compared against Wireshark 0.99.5 dissectors. Field formats omit data types and encodings, analysis is at byte granularity so sub-byte flags are missed, and field semantics are limited to direction fields; timestamps, checksums and addresses are not identified. Message boundaries rely on assuming a synchronous protocol, unused fixed-length fields after an ICQ length field were merged into the variable-length field, and the authors state that the techniques are not fully resistant against obfuscation.",
  "scope_limitations_zh": "方法每次提取一条接收报文的格式，且只覆盖提供给分析的报文；从未出现的报文仍然未知，程序发送的报文也不在分析范围内。它不推断协议状态机。评测覆盖 11 个 2007 年前后的程序，实现 DNS、HTTP、IRC、ICQ 与 Samba 五种协议，以 Windows 服务端为主，另含一个 ICQ 客户端和一个 Linux 上的 Samba 服务端；每种协议选取一条代表性报文，并与 Wireshark 0.99.5 的解析器对比。字段格式不包括数据类型与编码；分析以字节为粒度，因此会遗漏不足一字节的标志位；字段语义仅限于指向字段，不识别时间戳、校验和或地址。报文边界依赖同步协议这一假设；ICQ 长度字段之后未使用的定长字段被并入了变长字段。作者也说明这些技术尚不能完全抵御混淆。",
  "targets": [
    "protocol"
  ],
  "title": "Polyglot: Automatic Extraction of Protocol Message Format using Dynamic Binary Analysis",
  "title_zh": "Polyglot：基于动态二进制分析的协议报文格式自动提取",
  "url": "https://dl.acm.org/doi/10.1145/1315245.1315286",
  "venue": "ACM CCS 2007",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19",
  "why_fits_en": "Adds binary-analysis inference of protocol message formats from a running implementation, the line of work that the collection's BinPRE record continues, complementing its trace-based protocol research.",
  "why_fits_zh": "补充依据运行中的实现、以二进制分析推断协议报文格式的研究，合集中的 BinPRE 条目延续了这一方向，并与合集里基于流量的协议研究互补。",
  "year": 2007
}