.png){kind=icon}
返回
FieldWeaver: A visual–language approach to binary protocol format inference
.png){kind=icon}
PRE
AI
DOI：10.1016/j.comnet.2026.112573.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Protocol Reverse Engineering (PRE) is the foundation of many network protocol security analysis techniques. However, the implicit nature of field features in binary protocols increases the complexity of format analysis, making it a significant challenge in PRE. Most existing methods treat field boundary identification and semantic inference as separate tasks, and their inference methods often rely heavily on expert knowledge, leading to limited effectiveness and poor adaptability to diverse protocol types. To address these challenges, we present FieldWeaver, a visual–language approach to binary protocol format inference. FieldWeaver first converts protocol messages into a visual image and leverages multidimensional texture features to identify potential field boundaries. It then employs prompt engineering to guide a large language model (LLM) in extracting high-confidence semantic regions from messages. Finally, a format conflict resolution module integrates these results to generate the final protocol format. We evaluated FieldWeaver on nine widely used protocols. The experimental results show that in the identification of the boundary of the field, FieldWeaver achieved a Precision of 0.79, a Recall of 0.78, an F1-score of 0.78 and a Perfection of 0.42, outperforming four other baseline methods. In semantic inference, it obtained scores of 1.74 in Precise Semantic (PS) and 3.67 in Total Semantics (TS), also surpassing the baseline methods. We further assessed its stability using three different LLMs, and the results show a maximum F1 difference of only 0.05, demonstrating strong robustness. Experiments on five real-world IoT devices further confirm the practicality and effectiveness of our method. Finally, we present an example of applying FieldWeaver’s inferred results to a downstream task: protocol state machine inference.
Keyword:
Binary protocol
Reverse engineering
Message visualization
Prompt engineering
Format inference
