Analyzing Network Protocols of Application Layer Using Hidden Semi-Markov Model

Table 2

HTTP message format inferred by Discoverer. (, “XXX”) means a constant field, “” means constant, “” means text, and “XXX” is the value of the field; () means a variable field.

Field ID	Token	Field ID	Token	Field ID	Token
1	(, “GET”)	8	(, “User-Agent:”)	15	()
2	()	9	()	16	(, “(x86_64)”)
3	(, “HTTP/1.1”)	10	(, “ocspd”)	17	()
4	(, “Host:”)	11	()	18	(, “Connection:”)
5	()	12	(, “(unknown”)	19	()
6	(, “.com”)	13	()	20	⋯
7	()	14	(, “Darwin”)