Automatic mining of distinguishers with unknown protocol format

Unknown protocol inference are useful for many security application, including intrusion detection which always depends on deep packet inspection. However, mining distinguishers with unknown protocol format generally turns to protocol reverse engineering. In this paper, we propose a novel method for automatically abstracting protocol distinguishers based on statistic and our method is proved to be a good tool in finding protocol specifications. To implement and validate our method, we deign a serial of experiments. Then, applied to analyze of the indicators - recall is 99% while precise equals 99.9%, the method was proved highly efficient in the real-world environment.