Abstract: Protocol reverse engineering is one of the important steps in fuzzy test field.Aiming at the problem that there is no good systematic method for the format mining of variable-length domain and the mining of keyword domain boundary of variable-length domain is not ideal in the private binary protocol,a method to deal with the length domain and keyword domain separately in variable-length domain is proposed.For the length domain,using the results of progressive multi-sequence alignment,the global length domain and the local length domain are respectively mined by using the iterative window mining method,and test on the data set constructed by SNMP protocol shows it has a good boundary mining effect.For the keyword domain,in view of the problem that the former boundary of the keyword domain cannot be mined with the existing methods,by improving the voting expert algorithm,and adding the reverse search tree,the front the back boundaries of the keyword domain can be mined at the same time.Test on the data set constructed by ICMP and HTTP protocol show that,there is greatl improvement compared with the traditional voting expert algorithm.

Key words: Binary protocol, Iterative window, Progressive multiple sequence comparison, Protocol format mining, Voting expert algorithm