Awesome REA
中文Star on GitHubStar1.1k stars
Star on GitHubStar1.1k stars

Tool

PULSAR

Research prototype by Hugo Gascon and colleagues that learns a model of an unknown network protocol from recorded traffic. Messages extracted from PCAP traces are embedded as token or n-gram vectors, clustered by matrix factorization through the PRISMA R module, and turned into a Markov-chain state model with message templates and rules linking fields to earlier messages, written out as model files and a Graphviz state graph. The same models drive the tool's session simulator and stateful fuzzer, described in the authors' SecureComm 2015 paper; this entry covers only the protocol-learning part.

Targets
Protocol
Category
Protocol analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Reviewed at master commit 3c61178 (2022-06-07), the last push; the repository has no releases or tags, and the CLI reports itself as v0.1-dev. Contributed changes merged in 2021 converted the code from Python 2 to Python 3 with 2to3. There are no tests or CI configuration.
  • Learning takes PCAP traces of the protocol under study, or the captures that Cuckoo sandbox stored for analyzed samples. The repository commits one example model, models/itunes-xbmc, with the roughly 3 MB iTunes–XBMC capture it was learned from (itunes-xbmc.pcap, part of the 2015 initial commit) and its intermediate Derrick, Sally and Harry files; it bundles no other target data.
  • INSTALL.md has users clone the PRISMA R module into pulsar/modules, build Konrad Rieck's Derrick and Sally C tools from their repositories, install R, Wireshark's mergecap and Graphviz, and pip-install pygraphviz, progressBar, NumPy and python-Levenshtein, giving package commands for CentOS only. Dependencies are unpinned; PRISMA was last updated in 2018, and Derrick and Sally in 2019.
  • The README points to the SecureComm 2015 paper for the method and to an AISec 2012 paper on learning stateful models for network honeypots; results reported there are the authors'. Learned templates and state machines are statistical approximations that need analyst validation.
  • BSD-3-Clause (Copyright 2014 Hugo Gascon); the bundled pulsar/core/sippy SIP stack keeps its own GPL-2.0-or-later notices.

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · hgascon/pulsar · Revision 3c61178
  2. INSTALL.md GitHub · hgascon/pulsar · Revision 3c61178
  3. LICENSE GitHub · hgascon/pulsar · Revision 3c61178
  4. pulsar.py GitHub · hgascon/pulsar · Revision 3c61178
  5. pulsar/core/model.py GitHub · hgascon/pulsar · Revision 3c61178
  6. pulsar/core/cluster_generator.R GitHub · hgascon/pulsar · Revision 3c61178
  7. pulsar/conf/model.conf GitHub · hgascon/pulsar · Revision 3c61178
  8. models/itunes-xbmc GitHub · hgascon/pulsar · Revision 3c61178
  9. pulsar/core/sippy/SipCSeq.py GitHub · hgascon/pulsar · Revision 3c61178
  10. https://hugogascon.com/publications/2015-securecomm.pdf
  11. https://doi.org/10.1007/978-3-319-28865-9_18
  12. README.md GitHub · tammok/PRISMA · Revision a48624f

More in Protocols

All 140 entries in Protocols

↑↓ move↵ open⌘↵ new tab