{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T19:12:28Z","timestamp":1782846748523,"version":"3.54.5"},"reference-count":54,"publisher":"Association for Computing Machinery (ACM)","issue":"FSE","license":[{"start":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T00:00:00Z","timestamp":1782777600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"crossref","award":["62402278"],"award-info":[{"award-number":["62402278"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"name":"National Key Research and Development Project","award":["2024YFF1401300"],"award-info":[{"award-number":["2024YFF1401300"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Proc. ACM Softw. Eng."],"published-print":{"date-parts":[[2026,6,30]]},"abstract":"<jats:p>Protocol reverse engineering infers the specification of proprietary or poorly documented protocols and serves as the foundation for security analysis such as fuzz testing. While many existing techniques achieve this by mining statistical features from network traces, they face increasing challenges due to incomplete field pattern information available in the traces. Although protocol development has accumulated rich prior knowledge about protocol design, this knowledge remains largely untapped in protocol reverse engineering.  \n This paper introduces TransRE, a protocol reverse engineering tool that leverages prior syntax knowledge from standardized protocols through deep transfer learning to better understand proprietary protocols. TransRE first selects optimal source domains by analyzing inter-domain differences between the existing knowledge base and the target protocol. It then employs a neural network to extract representation features and applies domain adaptation techniques to optimize the syntax transfer model, enabling accurate inference of protocol formats. Our evaluation on 12 widely used protocols shows that TransRE identifies fields with a perfection score of 0.43, which is 1.48\u00d7-3.07\u00d7 the performance achieved by five state-of-the-art methods. Furthermore, to demonstrate practical applicability, we enhanced an existing protocol fuzzer with TransRE for testing proprietary protocols in real-world network cameras and discovered four bugs.<\/jats:p>","DOI":"10.1145\/3797124","type":"journal-article","created":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T17:06:14Z","timestamp":1782839174000},"page":"636-656","source":"Crossref","is-referenced-by-count":0,"title":["Protocol Reverse Engineering via Deep Transfer Learning"],"prefix":"10.1145","volume":"3","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1663-8901","authenticated-orcid":false,"given":"Yanyang","family":"Zhao","sequence":"first","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6522-9269","authenticated-orcid":false,"given":"Zhengxiong","family":"Luo","sequence":"additional","affiliation":[{"name":"National University of Singapore, Singapore, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-1433-4690","authenticated-orcid":false,"given":"Wenlong","family":"Zhang","sequence":"additional","affiliation":[{"name":"Central South University, Changsha, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-1363-5525","authenticated-orcid":false,"given":"Feifan","family":"Wu","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2701-4296","authenticated-orcid":false,"given":"Yuanliang","family":"Chen","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1360-9814","authenticated-orcid":false,"given":"Fuchen","family":"Ma","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-7229-3073","authenticated-orcid":false,"given":"Qi","family":"Xu","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9040-7247","authenticated-orcid":false,"given":"Heyuan","family":"Shi","sequence":"additional","affiliation":[{"name":"Central South University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0955-503X","authenticated-orcid":false,"given":"Yu","family":"Jiang","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,6,30]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2015.2444095"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1109\/RTCSA.2005.85"},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/IFIPNetworking.2015.7145307"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/ASIANCON51346.2021.9544603"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","unstructured":"Georges Bossert Fr\u00e9d\u00e9ric Guih\u00e9ry and Guillaume Hiet. 2014. Towards automated protocol reverse engineering using semantic information. (2014) 51-62. doi:10.1145\/2590296.2590346 10.1145\/2590296.2590346","DOI":"10.1145\/2590296.2590346"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653737"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2023.23131"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.5745"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICPR48806.2021.9412769"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2009.14"},{"key":"e_1_2_1_12_1","volume-title":"Proceedings of the 16th USENIX Security Symposium","author":"Cui Weidong","year":"2007","unstructured":"Weidong Cui, Jayanthkumar Kannan, and Helen J. Wang. 2007. Discoverer: Automatic Protocol Reverse Engineering from Network Traces. In Proceedings of the 16th USENIX Security Symposium, Boston, MA, USA, August 6-10, 2007, Niels Provos (Ed.). USENIX Association. https:\/\/www.usenix.org\/conference\/16th-usenix-security-symposium\/discovererautomatic-protocol-reverse-engineering-network"},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2011.114"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-"},{"key":"e_1_2_1_15_1","unstructured":"Michael Eddington. 2023. Peach Fuzzing Platform. https:\/\/gitlab.com\/gitlab-org\/security-products\/protocol-fuzzer-ce."},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-41540-6_25"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3325391"},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1049\/ir:19920155"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2017.36"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690299"},{"key":"e_1_2_1_21_1","unstructured":"jtpereyda. 2023. BooFuzz: Network Protocol Fuzzing for Humans. https:\/\/github.com\/jtpereyda\/boofuzz."},{"key":"e_1_2_1_22_1","volume-title":"NEMESYS: Network Message Syntax Reverse Engineering by Analysis of the Intrinsic Structure of Individual Messages. In WOOT @ USENIX Security Symposium (Baltimore, MD, USA) (WOOT'18)","author":"Kleber Stephan","year":"2018","unstructured":"Stephan Kleber, Henning Kopp, and Frank Kargl. 2018. NEMESYS: Network Message Syntax Reverse Engineering by Analysis of the Intrinsic Structure of Individual Messages. In WOOT @ USENIX Security Symposium (Baltimore, MD, USA) (WOOT'18). USENIX Association, USA, 8. https:\/\/www.usenix.org\/conference\/woot18\/presentation\/kleber"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMST"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE62328.2024.00058"},{"key":"e_1_2_1_25_1","volume-title":"Proceedings 2024 Network and Distributed System Security Symposium. https:\/\/api.semanticscholar.org\/CorpusID:267623524","author":"Luo Zhengxiong","year":"2024","unstructured":"Zhengxiong Luo, Kai Liang, Yanyang Zhao, Feifan Wu, Junze Yu, Heyuan Shi, and Yu Jiang. 2024. DYNPRE: Protocol Reverse Engineering via Dynamic Inference. Proceedings 2024 Network and Distributed System Security Symposium. https:\/\/api.semanticscholar.org\/CorpusID:267623524"},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/TCAD.2024.3444705"},{"key":"e_1_2_1_27_1","volume-title":"Bleem: Packet Sequence Oriented Fuzzing for Protocol Implementations.","author":"Luo Zhengxiong","year":"2023","unstructured":"Zhengxiong Luo, Junze Yu, Feilong Zuo, Jianzhong Liu, Yu Jiang, Ting Chen, Abhik Roychoudhury, and Jiaguang Sun. 2023. Bleem: Packet Sequence Oriented Fuzzing for Protocol Implementations. (2023). https:\/\/www.usenix.org\/ conference\/usenixsecurity23\/presentation\/luo-zhengxiong"},{"key":"e_1_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/DAC18072"},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1007\/1-4020-5261-8_36"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.14722\/bar"},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/3341302.3342087"},{"key":"e_1_2_1_32_1","unstructured":"mz automation. 2023. Official repository for libIEC61850 the open-source library for the IEC 61850 protocols. https: \/\/github.com\/mz-automation\/libiec61850.git."},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/SysEng.2017.8088251"},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.3390\/sym15030706"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833673"},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM52122.2024.10621405"},{"key":"e_1_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1155\/2017\/9324035"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2305.13483"},{"key":"e_1_2_1_39_1","unstructured":"stephane. 2023. A Modbus library for Linux Mac OS FreeBSD and Windows. https:\/\/github.com\/stephane\/libmodbus.git."},{"key":"e_1_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2112.02365"},{"key":"e_1_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICST.2017.32"},{"key":"e_1_2_1_42_1","unstructured":"TShark. 2023. TShark -Dump and analyze network traffic. https:\/\/www.wireshark.org\/docs\/man-pages\/tshark.html."},{"key":"e_1_2_1_43_1","volume-title":"Beyah","author":"Wang Qinying","year":"2021","unstructured":"Qinying Wang, Shouling Ji, Yuan Tian, Xuhong Zhang, Binbin Zhao, Yu Kan, Zhaowei Lin, Changting Lin, Shuiguang Deng, Alex X. Liu, and Raheem A. Beyah. 2021. MPInspector: A Systematic and Automatic Approach for Evaluating the Security of IoT Messaging Protocols. In USENIX Security Symposium. https:\/\/www.usenix.org\/conference\/ usenixsecurity21\/presentation\/wang-qinying"},{"key":"e_1_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/GreenCom.2012.120"},{"key":"e_1_2_1_45_1","volume-title":"Testing of COTP (Connection Oriented Transport Protocol) in ATN (Aeronautical Telecommunication Network). Ph. D. Dissertation","author":"Wirawan Jonathan Adi","unstructured":"Jonathan Adi Wirawan and Husni Fahmi. 2008. Testing of COTP (Connection Oriented Transport Protocol) in ATN (Aeronautical Telecommunication Network). Ph. D. Dissertation. Swiss German University. https:\/\/library.sgu.ac.id\/ index.php?p=show_detail&id=38441"},{"key":"e_1_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1145\/3650212.3680394"},{"key":"e_1_2_1_47_1","volume-title":"Charles: Web Debugging Proxy. https:\/\/www.charlesproxy.com\/.","year":"2023","unstructured":"xk72. 2023. Charles: Web Debugging Proxy. https:\/\/www.charlesproxy.com\/."},{"key":"e_1_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24531"},{"key":"e_1_2_1_49_1","unstructured":"Yerseg. 2023. Implementation of the S7comm protocol. https:\/\/github.com\/yerseg\/s7comm_investigation."},{"key":"e_1_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1145\/3649329.3658270"},{"key":"e_1_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM48880.2022.9796964"},{"key":"e_1_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2024.3468350"},{"key":"e_1_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2024.111022"},{"key":"e_1_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1109\/TCAD.2022.3201471"}],"container-title":["Proceedings of the ACM on Software Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3797124","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T18:38:25Z","timestamp":1782844705000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3797124"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6,30]]},"references-count":54,"journal-issue":{"issue":"FSE","published-print":{"date-parts":[[2026,6,30]]}},"alternative-id":["10.1145\/3797124"],"URL":"https:\/\/doi.org\/10.1145\/3797124","relation":{},"ISSN":["2994-970X"],"issn-type":[{"value":"2994-970X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,6,30]]}}}