{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,17]],"date-time":"2026-03-17T19:02:00Z","timestamp":1773774120869,"version":"3.50.1"},"reference-count":62,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Journal of Network and Computer Applications"],"published-print":{"date-parts":[[2026,5]]},"DOI":"10.1016\/j.jnca.2026.104426","type":"journal-article","created":{"date-parts":[[2026,2,13]],"date-time":"2026-02-13T08:11:56Z","timestamp":1770970316000},"page":"104426","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["ChatPRE: Knowledge-aware protocol analysis with LLMs for intelligent segmentation"],"prefix":"10.1016","volume":"249","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-4246-6532","authenticated-orcid":false,"given":"Guoyu","family":"Huo","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1574-6644","authenticated-orcid":false,"given":"Yuyao","family":"Huang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Fei","family":"Kang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Hui","family":"Shu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"78","reference":[{"key":"10.1016\/j.jnca.2026.104426_b1","series-title":"Proceedings of the 26th USENIX Conference on Security Symposium","first-page":"1093","article-title":"Understanding the mirai botnet","author":"Antonakakis","year":"2017"},{"key":"10.1016\/j.jnca.2026.104426_b2","series-title":"Qwen2.5-VL technical report","author":"Bai","year":"2025"},{"issue":"2","key":"10.1016\/j.jnca.2026.104426_b3","doi-asserted-by":"crossref","first-page":"451","DOI":"10.1016\/j.comnet.2012.08.003","article-title":"Automatic protocol reverse-engineering: Message format extraction and field semantics inference","volume":"57","author":"Caballero","year":"2013","journal-title":"Comput. Netw."},{"key":"10.1016\/j.jnca.2026.104426_b4","doi-asserted-by":"crossref","unstructured":"Caballero, J., Yin, H., Liang, Z., Song, D., 2007. Polyglot: Automatic extraction of protocol message format using dynamic binary analysis. In: Proceedings of the 14th ACM Conference on Computer and Communications Security.","DOI":"10.1145\/1315245.1315286"},{"key":"10.1016\/j.jnca.2026.104426_b5","doi-asserted-by":"crossref","unstructured":"Chandler, J., Wick, A., Fisher, K., 2023a. BinaryInferno: A Semantic-Driven Approach to Field Inference for Binary Message Formats. In: NDSS.","DOI":"10.14722\/ndss.2023.23131"},{"key":"10.1016\/j.jnca.2026.104426_b6","series-title":"Network and Distributed System Security Symposium","article-title":"BinaryInferno: A semantic-driven approach to field inference for binary message formats","author":"Chandler","year":"2023"},{"key":"10.1016\/j.jnca.2026.104426_b7","doi-asserted-by":"crossref","unstructured":"Choi, K., Son, Y., Noh, J., Shin, H., Choi, J., Kim, Y., 2016. Dissecting customized protocols: automatic analysis for customized protocols based on IEEE 802.15.4. In: Proceedings of the 9th ACM Conference on Security and Privacy in Wireless and Mobile Networks. Darmstadt, Germany, pp. 183\u2013193.","DOI":"10.1145\/2939918.2939921"},{"key":"10.1016\/j.jnca.2026.104426_b8","series-title":"CIPster: EtherNet\/IP (common industrial protocol) stack in C++","author":"contributors","year":"2025"},{"key":"10.1016\/j.jnca.2026.104426_b9","series-title":"civetweb: Embedded C\/C++ web server","author":"contributors","year":"2025"},{"key":"10.1016\/j.jnca.2026.104426_b10","doi-asserted-by":"crossref","unstructured":"Cui, W., Peinado, M., Chen, K., Wang, H.J., Briz, L.I., 2008. Tupni: Automatic reverse engineering of input formats. In: Proceedings of the 15th ACM Conference on Computer and Communications Security.","DOI":"10.1145\/1455770.1455820"},{"key":"10.1016\/j.jnca.2026.104426_b11","series-title":"Gemini: Google\u2019s suite of multimodal models","author":"DeepMind","year":"2024"},{"key":"10.1016\/j.jnca.2026.104426_b12","series-title":"Peach Fuzzing Platform","author":"Eddington","year":"2008"},{"key":"10.1016\/j.jnca.2026.104426_b13","series-title":"2020 IEEE Symposium on Security and Privacy","first-page":"1401","article-title":"I know where you parked last summer: Automated reverse engineering and privacy analysis of modern cars","author":"Frassinelli","year":"2020"},{"key":"10.1016\/j.jnca.2026.104426_b14","series-title":"Bsd licensed modbus rtu\/ascii and tcp slave","author":"freemodbus","year":"2025"},{"issue":"2\u20133","key":"10.1016\/j.jnca.2026.104426_b15","doi-asserted-by":"crossref","first-page":"146","DOI":"10.1080\/00437956.1954.11659520","article-title":"Distributional structure","volume":"10","author":"Harris","year":"1954","journal-title":"WORD"},{"key":"10.1016\/j.jnca.2026.104426_b16","series-title":"Hex-rays decompiler","author":"Hex-Rays","year":"2025"},{"key":"10.1016\/j.jnca.2026.104426_b17","series-title":"2024 Network and Distributed System Security Symposium","article-title":"DeGPT: Optimizing decompiler output with LLM","author":"Hu","year":"2024"},{"key":"10.1016\/j.jnca.2026.104426_b18","series-title":"Network and Distributed System Security Symposium","article-title":"DeGPT: Optimizing decompiler output with LLM","author":"Hu","year":"2024"},{"key":"10.1016\/j.jnca.2026.104426_b19","doi-asserted-by":"crossref","first-page":"161:1","DOI":"10.1145\/3580599","article-title":"Nsfuzz: Towards efficient and state-aware network service fuzzing - RCR report","volume":"32","author":"Hu","year":"2023","journal-title":"ACM Trans. Softw. Eng. Methodol."},{"key":"10.1016\/j.jnca.2026.104426_b20","series-title":"Proceedings of the IEEE International Symposium on Software Reliability Engineering","article-title":"MalPRE: Malware protocol reverse engineering through code slicing and agentic workflow","author":"Huang","year":"2025"},{"key":"10.1016\/j.jnca.2026.104426_b21","doi-asserted-by":"crossref","first-page":"238","DOI":"10.1016\/j.comcom.2021.11.009","article-title":"Protocol reverse-engineering methods and tools: A survey","volume":"182","author":"Huang","year":"2022","journal-title":"Comput. Commun."},{"key":"10.1016\/j.jnca.2026.104426_b22","series-title":"IDA pro interactive disassembler","author":"IDA Pro","year":"2025"},{"key":"10.1016\/j.jnca.2026.104426_b23","series-title":"tftpx: TFTP server and client implementation in C","author":"ideawu","year":"2025"},{"key":"10.1016\/j.jnca.2026.104426_b24","series-title":"Pin - A dynamic binary instrumentation tool","author":"Intel","year":"2025"},{"key":"10.1016\/j.jnca.2026.104426_b25","doi-asserted-by":"crossref","unstructured":"Jiang, J., Zhang, X., Wan, C., Chen, H., Sun, H., Su, T., 2024a. BinPRE: Enhancing Field Inference in Binary Analysis Based Protocol Reverse Engineering. In: Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security.","DOI":"10.1145\/3658644.3690299"},{"key":"10.1016\/j.jnca.2026.104426_b26","series-title":"Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, CCS 2024, Salt Lake City, UT, USA, October 14\u201318, 2024","first-page":"3689","article-title":"BinPRE: Enhancing field inference in binary analysis based protocol reverse engineering","author":"Jiang","year":"2024"},{"key":"10.1016\/j.jnca.2026.104426_b27","series-title":"Binary code summarization: Benchmarking chatgpt\/gpt-4 and other large language models","author":"Jin","year":"2023"},{"issue":"1","key":"10.1016\/j.jnca.2026.104426_b28","doi-asserted-by":"crossref","first-page":"526","DOI":"10.1109\/COMST.2018.2867544","article-title":"Survey of protocol reverse engineering algorithms: Decomposition of tools for static traffic analysis","volume":"21","author":"Kleber","year":"2018","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"10.1016\/j.jnca.2026.104426_b29","series-title":"LangGraph","author":"Langchain","year":"2025"},{"key":"10.1016\/j.jnca.2026.104426_b30","series-title":"Small x86-32\/x64 FTP server","author":"LightFTP","year":"2025"},{"key":"10.1016\/j.jnca.2026.104426_b31","article-title":"Automatic protocol format reverse engineering through context-aware monitored execution","volume":"vol. 8","author":"Lin","year":"2008"},{"key":"10.1016\/j.jnca.2026.104426_b32","series-title":"lftp: Sophisticated command-line file transfer program","author":"Lukyanov","year":"2025"},{"key":"10.1016\/j.jnca.2026.104426_b33","doi-asserted-by":"crossref","unstructured":"Luo, Z., Liang, K., Zhao, Y., Wu, F., Yu, J., Shi, H., Jiang, Y., 2024a. DynPRE: Protocol reverse engineering via dynamic inference. In: Proc. NDSS. pp. 1\u201318.","DOI":"10.14722\/ndss.2024.24083"},{"key":"10.1016\/j.jnca.2026.104426_b34","series-title":"31st Annual Network and Distributed System Security Symposium, NDSS 2024, San Diego, California, USA, February 26 - March 1, 2024","article-title":"DynPRE: Protocol reverse engineering via dynamic inference","author":"Luo","year":"2024"},{"issue":"3","key":"10.1016\/j.jnca.2026.104426_b35","doi-asserted-by":"crossref","first-page":"1070","DOI":"10.1016\/j.jnca.2013.01.013","article-title":"Position-based automatic reverse engineering of network protocols","volume":"36","author":"Luo","year":"2013","journal-title":"J. Netw. Comput. Appl."},{"key":"10.1016\/j.jnca.2026.104426_b36","doi-asserted-by":"crossref","unstructured":"Marcovich, R., Grumberg, O., Nakibly, G., 2023. PISE: Protocol Inference using Symbolic Execution and Automata Learning. In: Proceedings 2023 Workshop on Binary Analysis Research. BAR 2023, San Diego, CA, USA, URL: https:\/\/www.ndss-symposium.org\/wp-content\/uploads\/bar2023-23010-paper.pdf.","DOI":"10.14722\/bar.2023.23002"},{"key":"10.1016\/j.jnca.2026.104426_b37","series-title":"Proceedings of the 31st Annual Network and Distributed System Security Symposium","article-title":"Large language model guided protocol fuzzing","author":"Meng","year":"2024"},{"key":"10.1016\/j.jnca.2026.104426_b38","series-title":"Llama 3.3: A collection of LLMs developed by meta AI","author":"Meta","year":"2024"},{"key":"10.1016\/j.jnca.2026.104426_b39","series-title":"Small, cross-platform HTTP server with useful directory listing","author":"miniweb","year":"2025"},{"key":"10.1016\/j.jnca.2026.104426_b40","article-title":"Privacy-preserving deep learning based malicious code detection","author":"Mu","year":"2025","journal-title":"J. Netw. Comput. Appl."},{"issue":"7","key":"10.1016\/j.jnca.2026.104426_b41","doi-asserted-by":"crossref","first-page":"191","DOI":"10.1007\/s10664-022-10233-3","article-title":"StateAFL: Greybox fuzzing for stateful network servers","volume":"27","author":"Natella","year":"2022","journal-title":"Empir. Softw. Eng."},{"key":"10.1016\/j.jnca.2026.104426_b42","series-title":"GPT-4o: A multilingual and multimodal model developed by OpenAI","author":"OpenAI","year":"2024"},{"key":"10.1016\/j.jnca.2026.104426_b43","series-title":"An EtherNet\/I.P. stack for I\/O adapter devices","author":"OpENer","year":"2025"},{"key":"10.1016\/j.jnca.2026.104426_b44","series-title":"Boofuzz Documentation","author":"Pereyda","year":"2020"},{"key":"10.1016\/j.jnca.2026.104426_b45","series-title":"libmodbus: A Modbus library for Linux, macOS, FreeBSD and Windows","author":"Raimbault","year":"2025"},{"key":"10.1016\/j.jnca.2026.104426_b46","series-title":"snap7: Multi-platform Ethernet communication suite for Siemens S7 PLCs (SCADACS fork)","author":"SCADACS","year":"2025"},{"key":"10.1016\/j.jnca.2026.104426_b47","article-title":"LLASM: Naming functions in binaries by fusing encoder-only and decoder-only LLMs","author":"Sha","year":"2024","journal-title":"ACM Trans. Softw. Eng. Methodol."},{"key":"10.1016\/j.jnca.2026.104426_b48","series-title":"32nd USENIX Security Symposium (USENIX Security 23)","first-page":"4967","article-title":"AIFORE: Smart fuzzing based on automatic input format reverse engineering","author":"Shi","year":"2023"},{"key":"10.1016\/j.jnca.2026.104426_b49","series-title":"32nd USENIX Security Symposium (USENIX Security 23)","article-title":"Extracting protocol format as state machine via controlled static loop analysis","author":"Shi","year":"2023"},{"key":"10.1016\/j.jnca.2026.104426_b50","series-title":"Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security","article-title":"Lifting network protocol implementation to precise format specification with security applications","author":"Shi","year":"2023"},{"key":"10.1016\/j.jnca.2026.104426_b51","unstructured":"Shi, J., et al., 2023d. AIFORE: Smart Fuzzing Based on Automatic Input Format Reverse Engineering. In: 32nd USENIX Security Symposium (USENIX Security 23)."},{"issue":"1","key":"10.1016\/j.jnca.2026.104426_b52","article-title":"A survey of automatic protocol reverse engineering approaches, methods, and tools on the inputs and outputs view","volume":"2018","author":"Sija","year":"2018","journal-title":"Secur. Commun. Netw."},{"key":"10.1016\/j.jnca.2026.104426_b53","series-title":"32\/64 Bit multi-platform ethernet s7 plc communication suite","author":"snap7","year":"2025"},{"key":"10.1016\/j.jnca.2026.104426_b54","series-title":"LLM4Decompile: Decompiling binary code with large language models","author":"Tan","year":"2024"},{"key":"10.1016\/j.jnca.2026.104426_b55","series-title":"A conglomerate of a number of versions of the BSD TFTP code","author":"tftpd-hpa","year":"2025"},{"key":"10.1016\/j.jnca.2026.104426_b56","series-title":"Computer Security\u2014ESORICS 2009. ESORICS 2009","first-page":"200","article-title":"ReFormat: automatic reverse engineering of encrypted messages","volume":"vol. 5789","author":"Wang","year":"2009"},{"key":"10.1016\/j.jnca.2026.104426_b57","series-title":"Wireshark: The world\u2019s most popular network protocol analyzer","author":"Wireshark Development Team","year":"2025"},{"key":"10.1016\/j.jnca.2026.104426_b58","series-title":"Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security","article-title":"ReSym: Harnessing LLMs to recover variable and data structure symbols from stripped binaries","author":"Xie","year":"2024"},{"key":"10.1016\/j.jnca.2026.104426_b59","series-title":"International Conference on Learning Representations","article-title":"React: Synergizing reasoning and acting in language models","author":"Yao","year":"2023"},{"key":"10.1016\/j.jnca.2026.104426_b60","doi-asserted-by":"crossref","unstructured":"Ye, Y., Zhang, Z., Wang, F., Zhang, X., Xu, D., 2021. NetPlier: Probabilistic Network Protocol Reverse Engineering from Message Traces. In: NDSS.","DOI":"10.14722\/ndss.2021.24531"},{"key":"10.1016\/j.jnca.2026.104426_b61","doi-asserted-by":"crossref","first-page":"215","DOI":"10.1016\/j.artint.2009.11.011","article-title":"Hidden semi-Markov models","volume":"174","author":"Yu","year":"2010","journal-title":"Artificial Intelligence"},{"key":"10.1016\/j.jnca.2026.104426_b62","series-title":"The Thirty-Eighth Annual Conference on Neural Information Processing Systems (NeurIPS 2024)","article-title":"Chain of agents: Large language models collaborating on long-context tasks","author":"Zhang","year":"2024"}],"container-title":["Journal of Network and Computer Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S1084804526000019?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S1084804526000019?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,3,17]],"date-time":"2026-03-17T16:11:28Z","timestamp":1773763888000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S1084804526000019"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5]]},"references-count":62,"alternative-id":["S1084804526000019"],"URL":"https:\/\/doi.org\/10.1016\/j.jnca.2026.104426","relation":{"is-supplemented-by":[{"id-type":"uri","id":"https:\/\/github.com\/huoyuxi\/ChatPRE","asserted-by":"subject"}]},"ISSN":["1084-8045"],"issn-type":[{"value":"1084-8045","type":"print"}],"subject":[],"published":{"date-parts":[[2026,5]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"ChatPRE: Knowledge-aware protocol analysis with LLMs for intelligent segmentation","name":"articletitle","label":"Article Title"},{"value":"Journal of Network and Computer Applications","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.jnca.2026.104426","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier Ltd. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"104426"}}