| Approach, method, tool, or author | Protocols analyzed or reverse engineered | Text | Binary | Hybrid | Others (unknown/undocumented) |
| Discoverer [4] | HTTP | RPC | SMB, CIFS | None | Polyglot [5] | HTTP, Samba, ICQ | DNS, IRC | None | None | AutoFormat [7] | HTTP, SIP | DHCP, RIP, OSPF | SMB, CIFS | None | Tupni [8] | HTTP, FTP | RPC, DNS, TFTP | None | WMF, BMP, JPG, PNG, TIF | ReFormat [9] | HTTP, MIME | IRC | None | One unknown protocol | Prospex [10] | SMTP, SIP | SMB | None | Agobot (C&C) | ProDecoder [11] | SMTP | SMB | None | None | Wang et al. [12] | ICMP | ARP | None | None | ProGraph [13] | HTTP | DNS, BitTorrent, WeChat | None | None | Cai et al. [14] | HTTP, SSDP | DNS, BitTorrent, QQ, NetBios | None | None | WASp [15] | None | None | None | Smart plug & PSD systems |
|
|