Iterative development of protocol parsers
AssigneeForescout Technologies, Inc.
InventorsDaniel Ricardo dos Santos, Elisa Costante
Life of this patent
Estimating the term…
Abstract
Systems, methods, and related technologies for determining fields of an unknown protocol are described. One or more packets may be removed from a network traffic capture in response to the one or more packets having a known protocol. The remaining network traffic capture may be grouped into one or more clusters of packets based on similarity. Each of the one or more clusters may be parsed to identify one or more fields of an unknown protocol. The network traffic capture may be modified, including annotating the one or more fields of the unknown protocol.
Claims19
A method, comprising:
- removing one or more packets from a network traffic capture in response to the one or more packets having a known protocol;
- grouping the network traffic capture without the one or more packets having the known protocol, into one or more clusters of packets based on similarity;
- parsing each of the one or more clusters to identify one or more fields of an unknown protocol;
- modifying the network traffic capture including annotating the identified one or more fields of the unknown protocol;
- and
- generating without user input, a protocol parser, including parsing each of the annotated one or more fields of the unknown protocol to generate a description of the unknown protocol comprising identified one or more fields of the unknown protocol and an order of the identified one or more fields of the unknown protocol, and compiling the description into the protocol parser.
A system, comprising:
- a memory;
- and
- a processing device, operatively coupled to the memory, to:
- remove one or more packets from a network traffic capture in response to the one or more packets having a known protocol;
- group the network traffic capture without the on or more packets having the known protocol, into one or more clusters of packets based on similarity;
- parse each of the one or more clusters to identify one or more fields of an unknown protocol;
- modify the network traffic capture including annotating the identified one or more fields of the unknown protocol;
- and
- generating without user input, a protocol parser, including parsing each of the annotated one or more fields of the unknown protocol to generate a description of the unknown protocol comprising identified one or more fields of the unknown protocol and an order of the identified one or more fields of the unknown protocol, and compiling the description into the protocol parser.
A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:
- remove one or more packets from a network traffic capture in response to the one or more packets having a known protocol;
- group the network traffic capture without the one or more packets having the known protocol, into one or more clusters of packets based on similarity;
- parse each of the one or more clusters to identify one or more fields of an unknown protocol;
- modify the network traffic capture including annotating the identified one or more fields of the unknown protocol;
- and
- generating without user input, a protocol parser, including parsing each of the annotated one or more fields of the unknown protocol to generate a description of the unknown protocol comprising identified one or more fields of the unknown protocol and an order of the identified one or more fields of the unknown protocol, and compiling the description into the protocol parser.
Dependencies are inferred from the claim text.