Imagine you've recorded every phone call in a building for a month — you have audio files, timestamps, caller IDs. But you don't know what the conversations meant. To figure out whether someone leaked a secret, you'd need to reconstruct which calls were part of which negotiation, decode the language, and then check whether any eavesdropper could have pieced together the sensitive information just by listening. That's exactly what this paper does, but for network protocols instead of phone calls. The eavesdropper is a formal Dolev-Yao passive intruder — the canonical theoretical model of a network spy who can see everything on the wire but can't tamper with messages. The committed claim: given a PCAP file, a formal protocol specification in AnBx, and deployment metadata (keys, identities), this toolchain automatically reconstructs what a passive Dolev-Yao intruder would have learned, validated against the spec. This is not a new attack tool. It's a forensic reconstruction engine — it answers the question "what did the eavesdropper actually see and derive?" after the fact, specification-guided rather than heuristic. Three concrete engineering problems get solved. First, TCP streams contain multiple serialized Java objects and object references that have to be disentangled. Second, when multiple protocol sessions run concurrently over interleaved connections, the toolchain must figure out which packets belong to which session — a combinatorial assignment problem. Third, candidate reconstructions must be semantically validated: just because you can parse the bytes doesn't mean they constitute a valid protocol execution. The Dolev-Yao derived checks generated by the AnBx compiler serve as the semantic filter. The numbers are solid within their scope. On 121 protocols from the AnBx test suite using standard JDK crypto, 97.8% of expected serialized objects are recovered and 94.2% of single-session traces reconstruct successfully (meaning full object recovery plus a clean passive-intruder execution). For concurrent sessions — 112 protocols tested with both 2 and 3 parallel sessions — reconstruction succeeds 89.3% of the time while still recovering ~97.2% of objects. The drop from single to multi-session is modest and well-characterized. The integrity picture is mixed in a predictable way. All 121 protocols come from the AnBx test suite — which means the tool is validated on specifications it was designed to consume. The authors do test robustness by feeding mismatched protocol-role mappings and deliberately mutated traces, showing that the Dolev-Yao checks correctly flag semantic inconsistencies. But there's no independent benchmark suite, no third-party protocol corpus, and no real-world PCAP from a production network. The validation is honest within its scope but entirely self-contained. The architecture lives in the formal-methods-meets-systems-security niche. AnBx is an Alice-and-Bob-style protocol specification language; the compiler generates Java code including Dolev-Yao derivation checks. The reconstruction pipeline is deterministic: PCAP parsing → Java deserialization → session assignment (brute-force combinatorial for small session counts) → passive intruder execution → validation. No ML, no heuristics at the core — this is specification-driven reconstruction. The scalability question is whether the combinatorial session-assignment step explodes with more concurrent sessions or more complex protocols. The obvious next experiment is running this on real captured traffic from a production deployment — not a controlled test-suite capture. The authors almost certainly didn't do this because (a) real traffic introduces noise, fragmentation, and non-standard implementations that would break the clean Java-serialization assumption, and (b) getting real surveillance captures with matching protocol specs and keys is legally and logistically hard. This is the gap between a validated methodology and a deployed forensic tool. The paper is honest about being the former.
