ProfistMAC: A Protocol Finite State Machine Classifier via Graph Representation

Protocol finite state machines (PFSMs) describe the message sequence and inter-behavior between communication entities, deemed downstream targets in the workflow of protocol reverse engineering. Subtle logic flaws and high-order vulnerability are implied in deviant protocol finite state machines, thus prevalent assortments of security applications are conducted with the support of PFSMs. The availability of network traces enables reverse approaches of unknown protocols while incurring a risk of inferring PFSMs from network traces collected from malfunction protocol implementation. Furthermore, redundancy, abstraction, and massive expertise involvement of PFSMs are the main practical issues encountered in PFSM-driven protocol security applications. In this work, we tackle the problems above by achieving a fine-grained classification of PFSMs deviations, aiming to provide a global understanding of protocol implementation and potential vulnerability issues. Distinguished from previous PFSM-driven applications, our proposed architecture is the first to focus on few-shot deviant PFSM categorization, which targets the novel representation of PFSMs and state redundancy challenges. Our evaluations show the effectiveness of the meta-learning strategies selected, classification performance, and the effects of data imbalance. Compared with potential PFSMs categorization methods employed in the feature extraction stage, our proposed framework achieves 95.37% accuracy. Our code is available at https://github.com/toXiique/ProfistM AC-A-Protocol-Finite-State-Machine-Classifier-via-Graph-Representation.