Automatic Clustering of a Network Protocol with Weakly-Supervised Clustering
This work addresses the need for automated abstraction in network protocol analysis, reducing reliance on domain experts, but it is incremental as it applies an existing clustering approach to a specific protocol.
The paper tackles the problem of manually defining abstractions for network protocol behavioral models by introducing an automatic method using weakly-supervised clustering on the TLS protocol, achieving a perfect match with a manually constructed reference abstraction using only a few labeled examples.
Abstraction is a fundamental part when learning behavioral models of systems. Usually the process of abstraction is manually defined by domain experts. This paper presents a method to perform automatic abstraction for network protocols. In particular a weakly supervised clustering algorithm is used to build an abstraction with a small vocabulary size for the widely used TLS protocol. To show the effectiveness of the proposed method we compare the resultant abstract messages to a manually constructed (reference) abstraction. With a small amount of side-information in the form of a few labeled examples this method finds an abstraction that matches the reference abstraction perfectly.