.png){kind=icon}
.png){kind=icon}
Return
ChatPRE: Knowledge-aware protocol analysis with LLMs for intelligent segmentation
.png){kind=icon}
PRE
AI
DOI：10.1016/j.jnca.2026.104426.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
In the field of network security, protocol reverse engineering (PRE) is one of the core technologies. However, existing PRE methods face two key challenges: (1) heuristic-based field segmentation lacks robustness and requires extensive manual tuning for complex protocols, and (2) insufficient semantic rules hinder accurate inference of protocol semantics. To address these issues, this paper introduces ChatPRE, a novel three-stage framework that integrates program analysis with large language models (LLMs). In the field segmentation stage, dynamic taint tracking is combined with variable mapping on IDA pseudo-C code. Specifically, variable consistency is used instead of heuristic rules to locate field boundaries, while variable repetition clustering is applied to identify high-level semantic fields. For semantic inference, an agent workflow feeds pseudo-C code logic, field content, and contextual features into LLMs to infer functional semantics. Finally, field boundaries and annotations are globally refined through a re-inference step. Experiments on six standard protocols and one malware protocol demonstrate significant improvements over four baseline tools: ChatPRE achieves 11%–46% higher field segmentation accuracy and reduces segmentation errors by 63%–70%. Semantic inference accuracy is improved by 14%–45%. This work provides an innovative approach to PRE, which leverages LLMs to enhance both structural parsing and semantic understanding.
Keywords:
protocol reverse engineering
field segmentation
semantic inference
large language models
program analysis
Journal
IF:
8
Papers:
3.6K
Citations:
1.1W
Organization
No organization information available