Reverse Engineering Network Protocols Using Bioinformatics

Architecture and Background

Marshall Beddoe, Reverse Engineering Network Protocols using Bioinformatics Network protocol analysis is currently performed by hand using only intuition and a protocol analyzer tool such as tcpdump or Ethereal. This talk presents Protocol Informatics, a method for automating network protocol reverse engineering by utilizing algorithms found in the bioinformatics field.

Vulnerability Analysis

In order to determine fields in protocol packets, samples are aligned using multiple string alignment algorithms and their consensus sequences are analyzed to understand the beginning and the end of fields in the packet. Marshall Beddoe is currently a Research Scientist with McAfee, Inc.

Exploitation and Demonstrations

Prior to McAfee, Marshall worked for Foundstone performing general computer security research and development. His main focus is on the introduction of cross disciplinary methods and techniques into the realm of computer security.

Remediation and Defensive Strategies

He has performed extensive research on protocol analysis, passive network mapping and operating system identification. He can be reached at mbeddoe@insidiae.org.