{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,30]],"date-time":"2026-03-30T15:09:11Z","timestamp":1774883351520,"version":"3.50.1"},"reference-count":50,"publisher":"Springer Science and Business Media LLC","issue":"3","license":[{"start":{"date-parts":[[2026,2,10]],"date-time":"2026-02-10T00:00:00Z","timestamp":1770681600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,2,10]],"date-time":"2026-02-10T00:00:00Z","timestamp":1770681600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"funder":[{"DOI":"10.13039\/501100004735","name":"Natural Science Foundation of Hunan Province","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100004735","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Empir Software Eng"],"published-print":{"date-parts":[[2026,5]]},"DOI":"10.1007\/s10664-026-10814-6","type":"journal-article","created":{"date-parts":[[2026,2,10]],"date-time":"2026-02-10T10:58:45Z","timestamp":1770721125000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Scalable hierarchical protocol format inference via feature-heuristic message delimiter"],"prefix":"10.1007","volume":"31","author":[{"ORCID":"https:\/\/orcid.org\/0009-0009-0116-9303","authenticated-orcid":false,"given":"Bowen","family":"Hu","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Wenlong","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yanyang","family":"Zhao","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zhengxiong","family":"Luo","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Kai","family":"Liang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ronghua","family":"Shi","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yu","family":"Jiang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Heyuan","family":"Shi","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2026,2,10]]},"reference":[{"key":"10814_CR1","unstructured":"4SICS (2023). https:\/\/www.netresec.com\/?page=PCAP4SICS"},{"issue":"3","key":"10814_CR2","doi-asserted-by":"publisher","first-page":"403","DOI":"10.1016\/S0022-2836(05)80360-2","volume":"215","author":"SF Altschul","year":"1990","unstructured":"Altschul SF, Gish W, Miller W, Myers EW, Lipman DJ (1990) Basic local alignment search tool. J Mol Biol 215(3):403\u2013410","journal-title":"J Mol Biol"},{"key":"10814_CR3","doi-asserted-by":"publisher","unstructured":"Ankan A, Panda A (2015) pgmpy: Probabilistic graphical models using python. In: Huff K, Bergstra J (eds) Proceedings of the 14th Python in Science Conference 2015 (SciPy 2015), Austin, Texas, July 6 - 12, 2015, scipy.org, pp 6\u201311. https:\/\/doi.org\/10.25080\/Majora-7b98e3ed-001","DOI":"10.25080\/Majora-7b98e3ed-001"},{"key":"10814_CR4","unstructured":"Antonakakis M, April T, Bailey M, Bernhard M, Bursztein E, Cochran J, Durumeric Z, Halderman JA, Invernizzi L, Kallitsis M et\u00a0al (2017) Understanding the mirai botnet. In: 26th USENIX security symposium (USENIX Security 17), pp 1093\u20131110"},{"key":"10814_CR5","doi-asserted-by":"crossref","unstructured":"Bao T, Wang R, Shoshitaishvili Y, Brumley D (2017) Your exploit is mine: Automatic shellcode transplant for remote exploits. In: 2017 IEEE Symposium on Security and Privacy (SP)","DOI":"10.1109\/SP.2017.67"},{"issue":"2","key":"10814_CR6","doi-asserted-by":"publisher","first-page":"327","DOI":"10.1016\/0022-2836(87)90316-0","volume":"198","author":"GJ Barton","year":"1987","unstructured":"Barton GJ, Sternberg MJ (1987) A strategy for the rapid multiple alignment of protein sequences: confidence levels from tertiary structure comparisons. J Mol Biol 198(2):327\u2013337","journal-title":"J Mol Biol"},{"issue":"6","key":"10814_CR7","first-page":"1095","volume":"26","author":"MA Beddoe","year":"2004","unstructured":"Beddoe MA (2004) Network protocol analysis using bioinformatics algorithms. Toorcon 26(6):1095\u20131098","journal-title":"Toorcon"},{"key":"10814_CR8","doi-asserted-by":"crossref","unstructured":"Bermudez I, Tongaonkar A, Iliofotou M, Mellia M, Munaf\u00f2 MM (2015) Automatic protocol field inference for deeper protocol understanding. 2015 IFIP Networking Conference","DOI":"10.1109\/IFIPNetworking.2015.7145307"},{"key":"10814_CR9","unstructured":"binaryinferno (2023) Implementation of binaryinferno. https:\/\/github.com\/binaryinferno\/binaryinferno"},{"key":"10814_CR10","doi-asserted-by":"publisher","unstructured":"Borgolte K, Kruegel C, Vigna G (2013) Delta: automatic identification of unknown web-based infection campaigns. In: Sadeghi A, Gligor VD, Yung M (Eds) 2013 ACM SIGSAC Conference on Computer and Communications Security, CCS\u201913, Berlin, Germany, November 4-8, 2013, ACM, pp 109\u2013120. https:\/\/doi.org\/10.1145\/2508859.2516725","DOI":"10.1145\/2508859.2516725"},{"key":"10814_CR11","doi-asserted-by":"crossref","unstructured":"Bossert G, Guih\u00e9ry F, Hiet G (2014) Towards automated protocol reverse engineering using semantic information. Proceedings of the 9th ACM symposium on Information, computer and communications security","DOI":"10.1145\/2590296.2590346"},{"key":"10814_CR12","doi-asserted-by":"crossref","unstructured":"Caballero J, Yin H, Liang Z, Song DX (2007) Polyglot: automatic extraction of protocol message format using dynamic binary analysis. In ACM CCS 2007","DOI":"10.1145\/1315245.1315286"},{"key":"10814_CR13","doi-asserted-by":"publisher","unstructured":"Caselli M, Zambon E, Kargl F (2015) Sequence-aware intrusion detection in industrial control systems. In: Proceedings of the 1st ACM Workshop on Cyber-Physical System Security, ser. CPSS \u201915. New York, NY, USA: Association for Computing Machinery, pp 13\u201324. https:\/\/doi.org\/10.1145\/2732198.2732200","DOI":"10.1145\/2732198.2732200"},{"key":"10814_CR14","doi-asserted-by":"crossref","unstructured":"Chandler J, Wick A, Fisher K (2023) Binaryinferno: A semantic-driven approach to field inference for binary message formats. NDSS 2023","DOI":"10.14722\/ndss.2023.23131"},{"key":"10814_CR15","doi-asserted-by":"crossref","unstructured":"Cho CY, Babi\u00a0\u0107 D, Shin ECR, Song D (2010) Inference and analysis of formal models of botnet command and control protocols. In Proceedings of the 17th ACM conference on Computer and communications security, pp 426\u2013439","DOI":"10.1145\/1866307.1866355"},{"key":"10814_CR16","doi-asserted-by":"publisher","unstructured":"Comparetti PM, Wondracek G, Kr\u00fcgel C, Kirda E (2009) Prospex: Protocol specification extraction. In: 30th IEEE Symposium on Security and Privacy (S&P 2009), 17-20 May 2009, Oakland, California, USA. IEEE Computer Society, pp 110\u2013125. https:\/\/doi.org\/10.1109\/SP.2009.14","DOI":"10.1109\/SP.2009.14"},{"key":"10814_CR17","unstructured":"Cui W, Kannan J, Wang HJ (2007) Discoverer: Automatic protocol reverse engineering from network traces. In: USENIX Security Symposium"},{"key":"10814_CR18","unstructured":"Eddington M (2023) Peach fuzzing platform. https:\/\/gitlab.com\/gitlab-org\/security-products\/protocol-fuzzer-ce"},{"issue":"8","key":"10814_CR19","doi-asserted-by":"publisher","first-page":"1035","DOI":"10.1038\/nbt0804-1035","volume":"22","author":"SR Eddy","year":"2004","unstructured":"Eddy SR (2004) Where did the blosum62 alignment score matrix come from? Nat Biotechnol 22(8):1035\u20131036","journal-title":"Nat Biotechnol"},{"key":"10814_CR20","doi-asserted-by":"publisher","first-page":"351","DOI":"10.1007\/BF02603120","volume":"25","author":"D-F Feng","year":"1987","unstructured":"Feng D-F, Doolittle RF (1987) Progressive sequence alignment as a prerequisitetto correct phylogenetic trees. J Mol Evol 25:351\u2013360","journal-title":"J Mol Evol"},{"key":"10814_CR21","unstructured":"Fiddler (2023). https:\/\/www.telerik.com\/fiddler"},{"issue":"3","key":"10814_CR22","doi-asserted-by":"publisher","first-page":"705","DOI":"10.1016\/0022-2836(82)90398-9","volume":"162","author":"O Gotoh","year":"1982","unstructured":"Gotoh O (1982) An improved algorithm for matching biological sequences. J Mol Biol 162(3):705\u2013708","journal-title":"J Mol Biol"},{"key":"10814_CR23","doi-asserted-by":"crossref","unstructured":"Hoque ME, Chowdhury O, Chau SY, Nita-Rotaru C, Li N (2017) Analyzing operational behavior of stateful protocol implementations for detecting semantic bugs. In: 2017 47th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN)","DOI":"10.1109\/DSN.2017.36"},{"key":"10814_CR24","unstructured":"jtpereyda (2023) BooFuzz: Network protocol fuzzing for humans. https:\/\/github.com\/jtpereyda\/boofuzz"},{"key":"10814_CR25","doi-asserted-by":"publisher","unstructured":"Katoh K, Standley DM (2014) MAFFT: Iterative Refinement and Additional Methods. Totowa, NJ: Humana Press, pp 131\u2013146. https:\/\/doi.org\/10.1007\/978-1-62703-646-7_8","DOI":"10.1007\/978-1-62703-646-7_8"},{"issue":"14","key":"10814_CR26","doi-asserted-by":"publisher","first-page":"3059","DOI":"10.1093\/nar\/gkf436","volume":"30","author":"K Katoh","year":"2002","unstructured":"Katoh K, Misawa K, Kuma K-I, Miyata T (2002) Mafft: a novel method for rapid multiple sequence alignment based on fast fourier transform. Nucleic Acids Res 30(14):3059\u20133066","journal-title":"Nucleic Acids Res"},{"issue":"3","key":"10814_CR27","doi-asserted-by":"publisher","first-page":"487","DOI":"10.1101\/gr.113985.110","volume":"21","author":"SM Kie\u0142basa","year":"2011","unstructured":"Kie\u0142basa SM, Wan R, Sato K, Horton P, Frith MC (2011) Adaptive seeds tame genomic sequence comparison. Genome Res 21(3):487\u2013493","journal-title":"Genome Res"},{"key":"10814_CR28","unstructured":"Kleber S, Kopp H, Kargl F (2018) $$\\{$$NEMESYS$$\\}$$: Network message syntax reverse engineering by analysis of the intrinsic structure of individual messages. In: 12th USENIX Workshop on Offensive Technologies (WOOT 18)"},{"key":"10814_CR29","unstructured":"Kleber S, Kopp H, Kargl F (2018) Nemesys: Network message syntax reverse engineering by analysis of the intrinsic structure of individual messages. In: WOOT @ USENIX Security Symposium"},{"key":"10814_CR30","doi-asserted-by":"publisher","unstructured":"Leita C, Mermoud K, Dacier M (2005) Scriptgen: an automated script generation tool for honeyd. In: 21st Annual Computer Security Applications Conference (ACSAC 2005), 5-9 December 2005, Tucson, AZ, USA. IEEE Computer Society, pp 203\u2013214. https:\/\/doi.org\/10.1109\/CSAC.2005.49","DOI":"10.1109\/CSAC.2005.49"},{"key":"10814_CR31","doi-asserted-by":"crossref","unstructured":"Liang K, Luo Z, Zhao Y, Zhang W, Shi R, Jiang Y, Shi H, Hu C (2024) Mdiplier: Protocol format recovery via hierarchical inference. In: 2024 IEEE 35th international symposium on software reliability engineering (ISSRE). IEEE, pp 547\u2013557","DOI":"10.1109\/ISSRE62328.2024.00058"},{"key":"10814_CR32","unstructured":"Lin Z, Jiang X, Xu D, Zhang X (2008) Automatic protocol format reverse engineering through context-aware monitored execution. In: NDSS 2008"},{"issue":"4693","key":"10814_CR33","doi-asserted-by":"publisher","first-page":"1435","DOI":"10.1126\/science.2983426","volume":"227","author":"DJ Lipman","year":"1985","unstructured":"Lipman DJ, Pearson WR (1985) Rapid and sensitive protein similarity searches. Science 227(4693):1435\u20131441","journal-title":"Science"},{"key":"10814_CR34","unstructured":"Luo Z, Yu J, Zuo F, Liu J, Jiang Y, Chen T, Roychoudhury A, Sun J (2023) Bleem: Packet sequence oriented fuzzing for protocol implementations. In: 2023 32nd USENIX security symposium"},{"issue":"3","key":"10814_CR35","doi-asserted-by":"publisher","first-page":"443","DOI":"10.1016\/0022-2836(70)90057-4","volume":"48","author":"SB Needleman","year":"1970","unstructured":"Needleman SB, Wunsch CD (1970) A general method applicable to the search for similarities in the amino acid sequence of two proteins. J Mol Biol 48(3):443\u201353","journal-title":"J Mol Biol"},{"key":"10814_CR36","unstructured":"NetPlier (2023) Netplier: Probabilistic network protocol reverse engineering from message traces. https:\/\/github.com\/netplier-tool\/NetPlier"},{"key":"10814_CR37","unstructured":"netzob (2023) Netzob: Protocol reverse engineering, modeling and fuzzing. https:\/\/github.com\/netzob\/netzob"},{"key":"10814_CR38","doi-asserted-by":"crossref","unstructured":"Pacheco ML, von Hippel M, Weintraub B, Goldwasser D, Nita-Rotaru C (2022) Automated attack synthesis by extracting finite state machines from protocol specification documents. In: 2022 IEEE Symposium on Security and Privacy (SP)","DOI":"10.1109\/SP46214.2022.9833673"},{"key":"10814_CR39","unstructured":"T.U. PCAP (2023). https:\/\/weberblog.net\/the-ultimate-pcap"},{"issue":"7","key":"10814_CR40","doi-asserted-by":"publisher","first-page":"1641","DOI":"10.1093\/molbev\/msp077","volume":"26","author":"MN Price","year":"2009","unstructured":"Price MN, Dehal PS, Arkin AP (2009) Fasttree: computing large minimum evolution trees with profiles instead of a distance matrix. Mol Biol Evol 26(7):1641\u20131650","journal-title":"Mol Biol Evol"},{"key":"10814_CR41","unstructured":"SMIA2011 (2023). http:\/\/download.netresec.com\/pcap\/smia-2011"},{"key":"10814_CR42","unstructured":"B.\u00a0suite (2023). https:\/\/portswigger.net\/burp"},{"issue":"22","key":"10814_CR43","doi-asserted-by":"publisher","first-page":"4673","DOI":"10.1093\/nar\/22.22.4673","volume":"22","author":"JD Thompson","year":"1994","unstructured":"Thompson JD, Higgins DG, Gibson TJ (1994) Clustal w: improving the sensitivity of progressive multiple sequence alignment through sequence weighting, position-specific gap penalties and weight matrix choice. Nucleic Acids Res 22(22):4673\u20134680","journal-title":"Nucleic Acids Res"},{"key":"10814_CR44","unstructured":"TShark (2023) Tshark - dump and analyze network traffic. https:\/\/www.wireshark.org\/docs\/man-pages\/tshark.html"},{"key":"10814_CR45","doi-asserted-by":"publisher","unstructured":"von Hippel M, Vick C, Tripakis S, Nita-Rotaru C (2020) Automated attacker synthesis for distributed protocols. In: Casimiro A, Ortmeier F, Bitsch F, Ferreira P (eds) Computer Safety, Reliability, and Security - 39th International Conference, SAFECOMP 2020, Lisbon, Portugal, September 16-18, 2020, Proceedings, ser. Lecture Notes in Computer Science, vol 12234. Springer, pp 133\u2013149. https:\/\/doi.org\/10.1007\/978-3-030-54549-9_9","DOI":"10.1007\/978-3-030-54549-9_9"},{"key":"10814_CR46","unstructured":"vs-uulm (2023) Re-implementation of the protocol reverse engineering approach fieldhunter. https:\/\/github.com\/vs-uulm\/fieldhunter"},{"key":"10814_CR47","doi-asserted-by":"crossref","unstructured":"Wang Y, Zhang Z, Yao D, Qu B, Guo L (2011) Inferring protocol state machine from network traces: a probabilistic approach. In: Applied Cryptography and Network Security: 9th International Conference, ACNS (2011) Nerja, Spain, June 7\u201310, 2011. Proceedings 9. Springer, pp 1\u201318","DOI":"10.1007\/978-3-642-21554-4_1"},{"key":"10814_CR48","doi-asserted-by":"crossref","unstructured":"Ye Y, Zhang Z, Wang F, Zhang X, Xu D (2021) Netplier: Probabilistic network protocol reverse engineering from message traces. In: Proceedings 2021 network and distributed system security symposium","DOI":"10.14722\/ndss.2021.24531"},{"key":"10814_CR49","doi-asserted-by":"crossref","unstructured":"Yen J, L\u2019evai T, Ye Q, Ren X, Govindan R, Raghavan B (2021) Semi-automated protocol disambiguation and code generation. In: Proceedings of the 2021 ACM SIGCOMM Conference","DOI":"10.1145\/3452296.3472910"},{"issue":"2","key":"10814_CR50","doi-asserted-by":"publisher","first-page":"103","DOI":"10.1145\/235968.233324","volume":"25","author":"T Zhang","year":"1996","unstructured":"Zhang T, Ramakrishnan R, Livny M (1996) Birch: an efficient data clustering method for very large databases. ACM SIGMOD Rec 25(2):103\u2013114","journal-title":"ACM SIGMOD Rec"}],"container-title":["Empirical Software Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10664-026-10814-6.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10664-026-10814-6","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10664-026-10814-6.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,30]],"date-time":"2026-03-30T14:38:19Z","timestamp":1774881499000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10664-026-10814-6"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,2,10]]},"references-count":50,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2026,5]]}},"alternative-id":["10814"],"URL":"https:\/\/doi.org\/10.1007\/s10664-026-10814-6","relation":{},"ISSN":["1382-3256","1573-7616"],"issn-type":[{"value":"1382-3256","type":"print"},{"value":"1573-7616","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,2,10]]},"assertion":[{"value":"17 February 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"21 January 2026","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"10 February 2026","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors have no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflicts of Interest"}}],"article-number":"71"}}