SEMPRE infers protocol layouts with LLM search and traces
Original title: SEMPRE: Semantic-Aware Protocol Reverse Engineering via Consistency-Driven Joint Optimization
Semantic-field inference scored 0.72, against 0.13 for BinPRE, on a corpus of mainstream protocols.
SEMPRE is an automated protocol reverse-engineering framework that replaces hand-written rules with recursive LLM reasoning guided by taint-flow and loop traces. It slices messages into hierarchical fields, including nested sub-payloads, infers each field's type and role, and refines boundaries until structure and semantics converge. The abstract says it beat six state-of-the-art systems whose scores were under 0.4, and a case study on a prolific real-world botnet is offered as evidence of practical use.
Unconfirmed: The abstract omits SEMPRE's own structural score and does not name the botnet.
- The method targets undocumented formats, malware command-and-control, and IDS signatures.
- It uses tree-of-thought search constrained by dynamic program traces.
- High-confidence segments are frozen and detection is rerun under semantic constraints.
- The botnet in the case study is not named.
From the original article
1 min read at arxiv.orgProtocol reverse engineering (PRE) is essential for understanding undocumented or proprietary communication formats, enabling security-critical tasks such as vulnerability discovery, malware C2 analysis, and IDS signature generation. However, existing PRE techniques rely on brittle hand-written rules, under-model contextual dependencies among neighboring fields, and often fail on messages with nested sub-protocols.
By Yihua Xu · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.