Specification-Based Protocol Obfuscation - Chaire Cybersécurité sur l'analyse de la menace Accéder directement au contenu
Communication Dans Un Congrès Année : 2018

Specification-Based Protocol Obfuscation

Résumé

This paper proposes a new obfuscation technique of a communication protocol that is aimed at making the reverse engineering of the protocol more complex. The obfuscation is based on the transformation of protocol message format specification. The obfuscating transformations are applied to the Abstract Syntax Tree (AST) representation of the messages and mainly concern the ordering or aggregation of the AST nodes. The paper also presents the design of a framework that implements the proposed obfuscation technique by automatically generating, from the specification of the message format, a library performing the corresponding transformations. Finally, our framework is applied to two real application protocols (Modbus and HTTP) to illustrate the relevance and efficiency of the proposed approach. Various metrics recorded from the experiments show the significant increase of the complexity of the obfuscated protocol binary compared to the non-obfuscated code. It is also shown that the execution time and memory overheads remain acceptable for a practical deployment of the approach in operation.
Fichier principal
Vignette du fichier
bare_conf.pdf (886.65 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01848573 , version 1 (24-07-2018)

Identifiants

Citer

Julien Duchene, Eric Alata, Vincent Nicomette, Mohamed Kaâniche, Colas Le Guernic. Specification-Based Protocol Obfuscation. DSN 2018 - 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, Jun 2018, Luxembourg City, Luxembourg. pp.1-12, ⟨10.1109/DSN.2018.00056⟩. ⟨hal-01848573⟩
636 Consultations
262 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More