# PULSAR

> Research prototype by Hugo Gascon and colleagues that learns a model of an unknown network protocol from recorded traffic. Messages extracted from PCAP traces are embedded as token or n-gram vectors, clustered by matrix factorization through the PRISMA R module, and turned into a Markov-chain state model with message templates and rules linking fields to earlier messages, written out as model files and a Graphviz state graph. The same models drive the tool's session simulator and stateful fuzzer, described in the authors' SecureComm 2015 paper; this entry covers only the protocol-learning part.

- Type: Tool
- Targets: Protocol
- Category: Protocol analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-27
- Added to the catalog: 2026-11-03
- Original resource: <https://github.com/hgascon/pulsar>
- Primary source: <https://github.com/hgascon/pulsar/blob/3c6117818ef24de246bda2cdf12d9caa5c557177/README.md>
- Catalog page: <https://awesomerea.org/resources/pulsar/>
- Record JSON: <https://awesomerea.org/resources/pulsar/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/pulsar/index.md)

## Requirements & limits

- Reviewed at master commit 3c61178 (2022-06-07), the last push; the repository has no releases or tags, and the CLI reports itself as v0.1-dev. Contributed changes merged in 2021 converted the code from Python 2 to Python 3 with 2to3. There are no tests or CI configuration.
- Learning takes PCAP traces of the protocol under study, or the captures that Cuckoo sandbox stored for analyzed samples. The repository commits one example model, models/itunes-xbmc, with the roughly 3 MB iTunes–XBMC capture it was learned from (itunes-xbmc.pcap, part of the 2015 initial commit) and its intermediate Derrick, Sally and Harry files; it bundles no other target data.
- INSTALL.md has users clone the PRISMA R module into pulsar/modules, build Konrad Rieck's Derrick and Sally C tools from their repositories, install R, Wireshark's mergecap and Graphviz, and pip-install pygraphviz, progressBar, NumPy and python-Levenshtein, giving package commands for CentOS only. Dependencies are unpinned; PRISMA was last updated in 2018, and Derrick and Sally in 2019.
- The README points to the SecureComm 2015 paper for the method and to an AISec 2012 paper on learning stateful models for network honeypots; results reported there are the authors'. Learned templates and state machines are statistical approximations that need analyst validation.
- BSD-3-Clause (Copyright 2014 Hugo Gascon); the bundled pulsar/core/sippy SIP stack keeps its own GPL-2.0-or-later notices.

## Primary sources

1. <https://github.com/hgascon/pulsar/blob/3c6117818ef24de246bda2cdf12d9caa5c557177/README.md>
2. <https://github.com/hgascon/pulsar/blob/3c6117818ef24de246bda2cdf12d9caa5c557177/INSTALL.md>
3. <https://github.com/hgascon/pulsar/blob/3c6117818ef24de246bda2cdf12d9caa5c557177/LICENSE>
4. <https://github.com/hgascon/pulsar/blob/3c6117818ef24de246bda2cdf12d9caa5c557177/pulsar.py>
5. <https://github.com/hgascon/pulsar/blob/3c6117818ef24de246bda2cdf12d9caa5c557177/pulsar/core/model.py>
6. <https://github.com/hgascon/pulsar/blob/3c6117818ef24de246bda2cdf12d9caa5c557177/pulsar/core/cluster_generator.R>
7. <https://github.com/hgascon/pulsar/blob/3c6117818ef24de246bda2cdf12d9caa5c557177/pulsar/conf/model.conf>
8. <https://github.com/hgascon/pulsar/tree/3c6117818ef24de246bda2cdf12d9caa5c557177/models/itunes-xbmc>
9. <https://github.com/hgascon/pulsar/blob/3c6117818ef24de246bda2cdf12d9caa5c557177/pulsar/core/sippy/SipCSeq.py>
10. <https://hugogascon.com/publications/2015-securecomm.pdf>
11. <https://doi.org/10.1007/978-3-319-28865-9_18>
12. <https://github.com/tammok/PRISMA/blob/a48624f5102875984975ce99ddd687e0ddd6dee5/README.md>

## More in Protocols

- [CanLab](https://awesomerea.org/resources/canlab/index.md) · Tool
- [Facedancer](https://awesomerea.org/resources/facedancer/index.md) · Tool
- [Mirage](https://awesomerea.org/resources/mirage-wireless-framework/index.md) · Tool
- [Protobuf Decoder](https://awesomerea.org/resources/pawitp-protobuf-decoder/index.md) · Tool
- [gr-lora](https://awesomerea.org/resources/gr-lora/index.md) · Tool
- [termshark](https://awesomerea.org/resources/termshark/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.