Communication protocol reverse engineering of malwares is significant base for various network security applications.However

recent works have limited accuracy and integrity in identifying protocol fields and are especially weak in understanding fields' semantics.This paper proposed a method for communication protocol reverse engineering based on dynamic taint analysis.By building an extended taint propagation graph (ETPG) recording both instruction and function level behaviors of a malicious process

dividing the protocol data into different syntax fields and inducing the semantic information of individual fields were achieved.A prototype system was implemented and evaluated with malware samples.The results show that this method can divide the syntax fields and extract semantic information accurately and effectively.