Open Access

ARTICLE

: A Protocol Message Structure Reconstruction Method Based on Execution Slice Embedding

Yuyao Huang, Hui Shu, Fei Kang^*

Key Laboratory of Cyberspace Security, Ministry of Education, Zhengzhou, 450001, China

* Corresponding Author: Fei Kang. Email:

Computers, Materials & Continua 2026, 86(3), 37 https://doi.org/10.32604/cmc.2025.071552

Received 07 August 2025; Accepted 15 October 2025; Issue published 12 January 2026

Abstract

Message structure reconstruction is a critical task in protocol reverse engineering, aiming to recover protocol field structures without access to source code. It enables important applications in network security, including malware analysis and protocol fuzzing. However, existing methods suffer from inaccurate field boundary delineation and lack hierarchical relationship recovery, resulting in imprecise and incomplete reconstructions. In this paper, we propose ProRE, a novel method for reconstructing protocol field structures based on program execution slice embedding. ProRE extracts code slices from protocol parsing at runtime, converts them into embedding vectors using a data flow-sensitive assembly language model, and performs hierarchical clustering to recover complete protocol field structures. Evaluation on two datasets containing 12 protocols shows that ProRE achieves an average F1 score of 0.85 and a cophenetic correlation coefficient of 0.189, improving by 19% and 0.126% respectively over state-of-the-art methods (including BinPRE, Tupni, Netlifter, and QwQ-32B-preview), demonstrating significant superiority in both accuracy and completeness of field structure recovery. Case studies further validate the effectiveness of ProRE in practical malware analysis scenarios.

---

Keywords

---