## 4 Control Model
### Inferring Control Models from Program Internal Interactions Logs
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Method** & **Specification** & **Remarks** \\ \hline [PERSON] et al. [18] & Creating a protocol state machine & \begin{tabular}{c} Works on fixed-length binary protocol \\ message format. Tested on ARP, DHCP, TCP \\ and Kademlia \\ \end{tabular} \\ \hline PRISMA [28] & \begin{tabular}{c} Inferring a protocol state machine using the \\ Markov model todetermine message ordering \\ of the network traffic \\ \end{tabular} & Tested on SIP, DNS and FTP \\ \hline [PERSON] et al. [34] & \begin{tabular}{c} Constructing two FSMs:L-FSM for the \\ protocol language and S-FSM to show \\ protocol sessions’ state transitions \\ \end{tabular} & \begin{tabular}{c} Works on binary and text protocol \\ Protocol.keywords are identified before \\ thefinite state construction Tested onARP \\ and SMTP \\ \end{tabular} \\ \hline SpecMiner [10] & \begin{tabular}{c} Extracting the temporal behavioural model \\ from interaction traces Generalise a derived \\ FSA and minimises over-generalisation \\ \end{tabular} & \begin{tabular}{c} Assuming all message types are identified. \\ Tested on CVS client Amazon-EC2, \\ StringTokenizer, ZipOutput-Stream datasets \\ \end{tabular} \\ \hline [PERSON] et al. [35] & \begin{tabular}{c} Taking advantage of previously \\ defined/inferred protocols to complete \\ the specifications \\ \end{tabular} & \begin{tabular}{c} Integrating the rules and message formats \\ from different extensions into a single \\ specification. Cannot identity the obsolete \\ types and specifications. Tested on IETF \\ protocol (FTP) \\ \end{tabular} \\ \hline [PERSON] [41] & \begin{tabular}{c} Using neural network language models with \\ embedding is able to estimate \\ the conformance \\ \end{tabular} & \begin{tabular}{c} Adapting methods from language modelling \\ for dealing with large vocabularies and \\ unseen data. Tested on nqsb-TLS \\ \end{tabular} \\ \hline [PERSON] et al. [42] & \begin{tabular}{c} Using Self-taught deep learning a sparse \\ auto-encoder and softmax regression based \\ network for intrusion detection system \\ \end{tabular} & \begin{tabular}{c} Works offline. Tested on NSL-KDD \\ Cup dataset \\ \end{tabular} \\ \hline [PERSON] et al. [44] & \begin{tabular}{c} Extracting a request-response FSM then \\ identifies the general relationships \\ between/across message payload fields \\ \end{tabular} & \
\begin{tabular}{c} Improving Opaque SV. Tested on LDAP, \\ SOAP, Twitter and Googlebooks \\ \end{tabular} \\ \hline [PERSON] et al. [45] &
\begin{tabular}{c} Extracting contextual information in network \\ logs using graph-based causal inference \\ pruning and domain knowledge \\ \end{tabular} & Tested on backbone network logs, obtained \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Cont. merging two ARTIs who share the same child. The paper discovers all interactions and separate frequent interactions as the main flow by using different classification methods from infrequent interactions as outliers. A dynamic approach to infer temporal characteristics automatically from execution traces on the basis of a set of property pattern templates is presented by [PERSON] and [PERSON] [48]. The main contribution of the work is proposing a set of additions to the response property pattern (the cause-effect relationships between two abstract events) and an algorithm that can automatically deduce the strictest patterns that are satisfied by a set of events with a given scope. The method starts with instrumenting a program and executing it with multiple test suites. Then, it instantiates candidate temporal property patterns and calculates the satisfaction ratio table for each candidate pattern on the basis of the execution traces. Next, it infers the strongest pattern satisfied by each set of events and adds scope limitation for each pattern. The final validation of the inferred patterns is done by the user.