# A Novel Network Protocol Syntax Extracting Method for Grammar-Based Fuzzing
## 2 Related Work  
Snake_nlp [18] is an artificial intelligence extraction method based on protocol specifications. This method uses an NLP algorithm based on zero-shot learning to extract network protocol syntax information from RFC documents, with an accuracy of 0.82. Reference [24] is also an artificial intelligence extraction method based on protocol specifications. The author proposes a data-driven method for extracting finite state machines from protocol specification RFC documents. In paper [25], the author proposes a method of feature extraction and recognition using convolutional neural networks to extract syntax information of unknown protocols. This type of artificial intelligence method relies on a large amount of high-quality training data and is often designed for a specific format of the protocol specification document. For example, Snake_nlp [18] takes advantage of the feature in the RFC document that the protocol field is set as a title. This method has the problems of incomplete information extraction and insufficient accuracy. On the other hand, in MATT Security [26], the author monitors the MQTT protocol communication traffic and extracts syntax information such as message type, field structure, field position, and format of the protocol from the actual transmission data packets. Paper [27] also extracts field information and field boundary information in the data packet through real-time capture of data packets and a simple tag-based technology. This approach often relies on real-time capture of communication data, and for encrypted or compressed communication traffic, the accuracy and completeness of information extraction suffer. Furthermore, ProsegDL [28] is a software reverse engineering-based method that combines an image semantic segmentation model and a Siamese network to achieve format extraction within acceptable running time. In paper [29], the authors propose a new protocol reverse engineering method that uses the Continuous Sequence Pattern (CSP) algorithm to extract protocol specifications. NetPlier [30] is a protocol reverse engineering technique based on probabilistic network tracing that models the inherent uncertainty of the problem by introducing random variables to represent the likelihood of each field representing a packet type. In paper [31], the author conducts a comprehensive review of the research status and technological development of network protocol reverse engineering tools. Although this type of protocol reverse method can extract information such as protocol format and field boundaries, the inference of the protocol format is often not accurate enough.  
In summary, existing research has greatly promoted the development of the field of network protocol syntax information extraction but there is still no universal method that can meet the requirements of network protocol-related testing, which needs quick and comprehensive protocol syntax information extraction, and can be adapted to most existing protocols. For this reason, we propose the protocol syntax information extraction method based on the Wireshark protocol dissector file, which can extract protocol syntax information quickly, comprehensively, and accurately, and is applicable to all Wireshark-supported protocols.