The Closer You Look, The More You Learn: A Grey-box Approach to Protocol\n State Machine Learning

2021/06/04 by Chris McMahon Stone, Stone, Chris McMahon, Sam Thomas +9 · 1 citation
Computer Science · #Advanced Malware Detection Techniques #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Software System Performance and Reliability #Software Testing and Debugging Techniques

paper · pdf · doi:10.48550/arxiv.2106.02623

openalex publication_date 2021/06/04 · openalex created_date 2022/10/01 · openalex updated_date 2026/07/28

Abstract

In this paper, we propose a new approach to infer state machine models from\nprotocol implementations. Our method, STATEINSPECTOR, learns protocol states by\nusing novel program analyses to combine observations of run-time memory and\nI/O. It requires no access to source code and only lightweight execution\nmonitoring of the implementation under test. We demonstrate and evaluate\nSTATEINSPECTOR's effectiveness on numerous TLS and WPA/2 implementations. In\nthe process, we show STATEINSPECTOR enables deeper state discovery, increased\nlearning efficiency, and more insightful post-mortem analyses than existing\napproaches. Further to improved learning, our method led us to discover several\nconcerning deviations from the standards and a high impact vulnerability in a\nprominent Wi-Fi implementation.\n

Cited by

• Finding SSH Strict Key Exchange Violations by State Learning

Related

• Unleashing the Power of LLM to Infer State Machine from the Protocol Implementation
• State machine inference of QUIC
• Automatic State Machine Inference for Binary Protocol Reverse Engineering
• Extracting Protocol Format as State Machine via Controlled Static Loop Analysis
• LLM-Assisted Model-Based Fuzzing of Protocol Implementations