# Prospex: Protocol Specification Extraction > Prospex infers message formats and a protocol state machine from execution traces of a Linux server handling client sessions. Dynamic taint analysis splits each session into messages and recovers their formats; messages are then clustered into types by input-format, execution and server-impact similarity, such as the system calls, outputs and file paths a message triggers. The observed type sequences form an augmented prefix tree acceptor, which prerequisite and end-state heuristics label before Exbar computes a minimal consistent automaton. The resulting specifications are translated for the Peach fuzzer to reach later protocol states. The evaluation covers the Agobot command-and-control protocol, SMTP on Sendmail, SMB on Samba and SIP on Asterisk. - Authors: Paolo Milani Comparetti; Gilbert Wondracek; Christopher Kruegel; Engin Kirda - Venue: IEEE S&P 2009 - Status: Conference paper - Publication / posting date: May 2009 - Date source: IEEE’s Crossref deposit and an archived copy of the IEEE Xplore page give May 2009, represented at month precision. The symposium dates are not substituted for a publication day. - DOI: 10.1109/SP.2009.14 - Sources reviewed: 2026-10-19 - Added to the catalog: 2026-10-28 - Original paper: - PDF: - BibTeX: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/papers/paper-prospex/index.md) ## Scope and limitations Prospex traces one endpoint, the server, and its taint tool runs only on Linux, so only Linux server binaries were analyzed. It cannot handle encrypted traffic: TLS sessions made up the 6.5% of 31,903 Postfix sessions that the inferred SMTP specification could not parse. Training sets are small (for example 16 SMTP and 31 SMB sessions), and the inferred machines cover only behavior exercised during training; two SMB states are artifacts of limited training variety, and SMB recall against the reference automaton is 0.58. Reference state machines were built manually by the authors, and soundness was checked with 50,000 random walks per protocol; the sk-strings and beams baselines are state-machine learners, not full protocol reverse-engineering systems. The fuzzing case studies found previously known issues in an older Samba release and in Asterisk, not new vulnerabilities in the latest Samba or Windows XP SMB versions tested. ## Why it fits this collection Adds an execution-based method that extracts both message formats and protocol state machines from observed sessions, complementing the collection’s active state-machine learning and format-only protocol inference research. ## Publication and review notes Crossref and the archived IEEE Xplore page agree on the four authors, the 2009 30th IEEE Symposium on Security and Privacy proceedings, pages 110–125 and May 2009; Xplore does not mark the paper open access. The PDF is the 16-page copy on Christopher Kruegel’s UCSB site, with the same title and author order; its file metadata shows a September 2008 creation date and a 2009 IEEE PDF eXpress certification, and IEEE Xplore holds the version of record. The paper reports that its Peach statefulness extensions were integrated into Peach release 2.2 but links no Prospex code, traces or reference state machines. ## Primary sources 1. 2. 3. 4. ## About this entry Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.