Detecting Communication Protocol Security Flaws by Formal Fuzz Testing and Machine Learning
FORTE '08 Proceedings of the 28th IFIP WG 6.1 international conference on Formal Techniques for Networked and Distributed Systems
FM '09 Proceedings of the 2nd World Congress on Formal Methods
Angluin style finite state machine inference with non-optimal counterexamples
Proceedings of the First International Workshop on Model Inference In Testing
Generating models of infinite-state communication protocols using regular inference with abstraction
ICTSS'10 Proceedings of the 22nd IFIP WG 6.1 international conference on Testing software and systems
Iterative refinement of specification for component based embedded systems
Proceedings of the 2011 International Symposium on Software Testing and Analysis
Inferring canonical register automata
VMCAI'12 Proceedings of the 13th international conference on Verification, Model Checking, and Abstract Interpretation
A-GHSOM: An adaptive growing hierarchical self organizing map for network anomaly detection
Journal of Parallel and Distributed Computing
ISoLA'12 Proceedings of the 5th international conference on Leveraging Applications of Formal Methods, Verification and Validation: technologies for mastering change - Volume Part I
A finite transition model for security protocol verification
Proceedings of the 6th International Conference on Security of Information and Networks
Using transition systems to model and verify the implementation of security protocol
Proceedings of the 6th International Conference on Security of Information and Networks
KameleonFuzz: evolutionary fuzzing for black-box XSS detection
Proceedings of the 4th ACM conference on Data and application security and privacy
| Hi-index | 0.00 |
Security and reliability of network protocol implementations are essential for communication services. Most of the approaches for verifying security and reliability, such as formal validation and black-box testing, are limited to checking the specification or conformance of implementation. However, in practice, a protocol implementation may contain engineering details, which are not included in the system specification but may result in security flaws. We propose a new learning-based approach to systematically and automatically test protocol implementation security properties. Protocols are specified using Symbolic Parameterized Extended Finite State Machine (SP-EFSM) model, and an important security property - message confidentiality under the general Dolev-Yao attacker model - is investigated. The new testing approach applies black-box checking theory and a supervised learning algorithm to explore the structure of an implementation under test while simulating the teacher with a conformance test generation scheme. We present the testing procedure, analyze its complexity, and report experimental results.