{
  "added_at": "2026-11-03",
  "additional_evidence_urls": [
    "https://github.com/JG91/CNNPRE/blob/c7679ee4fb20fd7c3ff712b3e1287bdbbf171421/cnnpre.ipynb",
    "https://github.com/JG91/CNNPRE/tree/c7679ee4fb20fd7c3ff712b3e1287bdbbf171421/Data",
    "https://github.com/JG91/CNNPRE/tree/c7679ee4fb20fd7c3ff712b3e1287bdbbf171421/PCAP",
    "https://doi.org/10.1109/ACCESS.2023.3325391"
  ],
  "category": "protocol-analysis",
  "description_en": "Research code and data for CNNPRE, a message-type identification method for protocol reverse engineering by Javad Garshasbi and Mehdi Teimouri, published in IEEE Access in 2023. A single Colab notebook turns each message's padded bit string into a resized grayscale image, extracts features with an ImageNet-pretrained ResNet50 as transfer learning, adds message direction and length-group encodings, reduces the features with UMAP and clusters messages with agglomerative clustering and HDBSCAN, scoring each clustering against labelled message types. Preprocessed message datasets for twelve protocols, from ARP and DNS to SMTP and GSM, accompany the notebook.",
  "description_zh": "CNNPRE 的研究代码与数据。CNNPRE 是 Javad Garshasbi 与 Mehdi Teimouri 于 2023 年发表在 IEEE Access 上、用于协议逆向工程的报文类型识别方法。仓库中唯一的 Colab 笔记本把每条报文补齐后的比特串转为缩放的灰度图像，借助在 ImageNet 上预训练的 ResNet50 进行迁移学习以提取特征，加入报文方向和长度分组编码，用 UMAP 降维后再以凝聚聚类和 HDBSCAN 对报文聚类，并将各聚类结果与已标注的报文类型比较评分。笔记本附有从 ARP、DNS 到 SMTP、GSM 等十二种协议的预处理报文数据集。",
  "entry_url": "https://awesomerea.org/resources/cnnpre/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/cnnpre/",
  "evidence_url": "https://github.com/JG91/CNNPRE/blob/c7679ee4fb20fd7c3ff712b3e1287bdbbf171421/README.md",
  "group": "learn",
  "id": "cnnpre",
  "json_url": "https://awesomerea.org/resources/cnnpre/record.json",
  "kind": "research",
  "markdown_url": "https://awesomerea.org/resources/cnnpre/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/cnnpre/index.md",
  "name": "CNNPRE (IEEE Access 2023)",
  "name_zh": "CNNPRE：基于 CNN 的协议逆向方法（IEEE Access 2023）",
  "record_type": "resource",
  "relationship": "learning",
  "requirements": [
    "Paper: Javad Garshasbi and Mehdi Teimouri, “CNNPRE: A CNN-Based Protocol Reverse Engineering Method,” IEEE Access, vol. 11, pp. 116255–116268, 2023, DOI 10.1109/ACCESS.2023.3325391; Crossref lists it under CC BY-NC-ND 4.0. The repository was reviewed at its 2026-01-13 head, a README update; the notebook last changed on 2023-07-06, and there are no releases.",
    "The only code is cnnpre.ipynb, written for Google Colab. It pip-installs umap-learn and hdbscan, apt-installs TeX Live and pandoc for a PDF export, and otherwise relies on Colab's preinstalled TensorFlow, scikit-learn, OpenCV, pandas and yellowbrick without pinned versions. It downloads ImageNet ResNet50 weights, reads one hard-coded CSV (GSM5000-hex.csv) with a message count that must be edited for other datasets, and its last cells mount Google Drive to convert the notebook. There is no package, command-line tool or test.",
    "Inputs are message-level CSVs with direction, labelled message type and each message as hex and bit strings. Data/ holds preprocessed CSVs for ARP, DHCP, DNS, FTP, GSM, HTTP, ICMP, NBNS, NTP, POP, SMTP and Syslog, PCAP/ holds the GSM capture 44CON-gsm-uplink-downlink-sim-example.pcap, and the README names the public WRCCDC 2021 regional competition captures as the other source. No PCAP-to-CSV preprocessing script is included, so a new protocol needs its own conversion, and the notebook's evaluation metrics need ground-truth message types.",
    "The notebook covers message-type clustering only, not field, semantic or state-machine inference. Its results labelled K-Means take the cluster count from a K-means elbow search but cluster with agglomerative clustering, and the saved outputs show one GSM run. Accuracy figures are the paper's.",
    "GitHub detects no license and the repository has no license file, so the code and preprocessed datasets state no reuse terms; the paper's license covers the article, not the repository, and the captures keep their sources' terms."
  ],
  "requirements_zh": [
    "论文：Javad Garshasbi、Mehdi Teimouri，《CNNPRE: A CNN-Based Protocol Reverse Engineering Method》，IEEE Access 第 11 卷，第 116255–116268 页，2023 年，DOI 10.1109/ACCESS.2023.3325391；Crossref 标注其采用 CC BY-NC-ND 4.0 许可。仓库审阅对象为 2026-01-13 的最新提交（一次 README 更新）；笔记本最后修改于 2023-07-06，没有发布版本。",
    "唯一的代码是为 Google Colab 编写的 cnnpre.ipynb。它用 pip 安装 umap-learn 和 hdbscan，用 apt 安装 TeX Live 与 pandoc 以导出 PDF，其余依赖 Colab 预装的 TensorFlow、scikit-learn、OpenCV、pandas 和 yellowbrick，均未固定版本。它会下载 ImageNet 预训练的 ResNet50 权重，读取写死的 CSV 文件（GSM5000-hex.csv），换用其他数据集时需修改报文数量，最后几个单元格还会挂载 Google Drive 来转换笔记本。没有软件包、命令行工具或测试。",
    "输入是按报文组织的 CSV，包含方向、已标注的报文类型以及每条报文的十六进制和比特串。Data/ 收录 ARP、DHCP、DNS、FTP、GSM、HTTP、ICMP、NBNS、NTP、POP、SMTP 和 Syslog 的预处理 CSV，PCAP/ 收录 GSM 捕获文件 44CON-gsm-uplink-downlink-sim-example.pcap，README 指出其余数据来源是公开的 WRCCDC 2021 地区赛流量。仓库未提供从 PCAP 转换为 CSV 的预处理脚本，因此新协议需要自行转换，而笔记本的评估指标还需要真实的报文类型标注。",
    "笔记本只涉及报文类型聚类，不包括字段、语义或状态机推断。其中标为 K-Means 的结果用 K-means 肘部法确定聚类数，实际却用凝聚聚类完成聚类；保存的输出只显示一次 GSM 运行。准确率数据来自论文。",
    "GitHub 未检测到许可证，仓库也没有许可证文件，因此代码和预处理数据集均未声明复用条款；论文的许可只适用于文章本身，不适用于仓库，捕获流量遵循其来源的条款。"
  ],
  "targets": [
    "protocol"
  ],
  "url": "https://github.com/JG91/CNNPRE",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}