Automated reconstruction of passive Dolev-Yao intruders from PCAPs
Original title: Global Surveillance Under the Lens: Reconstructing Passive Dolev-Yao Intruders
Framework reconstructs protocol sessions and passive intruder executions from network captures using AnBx specifications, achieving 94.2% success on single-session protocols.
Global surveillance systems record PCAPs for retrospective analysis but lack protocol semantics. The methodology takes a PCAP capture, AnBx specification, and deployment metadata to extract Java-serialized objects from TCP streams, reconstruct sessions, and generate passive Dolev-Yao checks. It addresses multiple objects, interleaved connections, and semantic validation. Evaluated on 121 protocols, it recovers 97.8% objects and achieves 94.2% successful reconstruction for single sessions, and 89.3% for two/three concurrent sessions on parallel-capable protocols. Mismatched mappings and mutated traces produce detectable semantic inconsistencies.
- 97.8% object recovery and 94.2% reconstruction for single sessions
- 89.3% reconstruction for two and three concurrent sessions
- 97.2% object recovery on parallel protocols
- Handles multiple serialized objects and references
- Generates executable passive intruder from AnBx compiler
From the original article
1 min read at arxiv.orgGlobal surveillance systems record large volumes of network traffic for retrospective analysis, but packet captures alone reveal little about protocol-level semantics. This paper presents an automated, specification-guided methodology for reconstructing passive Dolev-Yao intruder executions from captured network traffic and validating the reconstructed executions against a formal protocol specification.
By Paolo Modesti · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.