Capturing Uncertainty Information and Categorical Characteristics for Network Payload Grouping in Protocol Reverse Engineering

Table 3

Protocol keywords extracted by AutoReEngine.

Protocol	Results without message grouping	Results with message grouping
HTTP	GET /, Referer: http://, Date:, HTTP/1.1, Keep-Alive, Accept:, Content-Length:, Last-Modified:, Accept-Encoding: gzip, Server:, Content-Type:, Connection:, Accept-Language: zh-cn, Host:, 200 OK, User-Agent: Mozilla/	GET /, Referer: http://, Date:, HTTP/1.1, Keep-Alive, Accept:, Content-Length:, Last-Modified:, Accept-Encoding: gzip, Server:, Content-Type:, Connection:, Accept-Language: zh-cn, Host:, 200 OK, User-Agent: Mozilla/, Origin:, Cache-Control:, POST, ITYPE:, OTYPE:
POP	USER, PASS, STAT, DATA, +OK Welcome to coremail Mail Pop3 Server, +OK core mail, message(s) [, +OK, byte(s)]	USER, PASS, STAT, DATA, +OK Welcome to coremail Mail Pop3 Server, +OK core mail, message(s) [, +OK, byte(s)] LIST, UIDL, CAPA
SMTP	EHLO, 250-PIPELINING, 220, 250-SIZE, 250-AUTH=LOGIN, 250 8BITMIME, 334, DATA, 250-AUTH LOGIN PLAIN,	EHLO, 250-PIPELINING, 220, 250-SIZE, 250-AUTH=LOGIN, 250 8BITMIME, 334, DATA, 250-AUTH LOGIN PLAIN, QUIT, RCPT TO, MAIL FROM
FTP	USER, PASS, 331, 30, 220, ready, User, logged in.	USER, PASS, 331, 30, 220, ready, User, logged in. QUIT, PSAV, SIZE, CMD, 150, 530