Detecting communication protocol security flaws by formal fuzz testing and machine learning

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 5048 LNCS, Issue , 2008, Pages 299-304

  Shu, Guoqiang ^a   Hsu, Yating ^a   Lee, David ^a  

^a The Ohio State University   (United States)

Author keywords

Fuzz testing; Protocol Synthesis; Security Testing

Indexed keywords

FORMAL METHODS; MACHINE LEARNING; NETWORK PROTOCOLS; ARTIFICIAL INTELLIGENCE; LEARNING SYSTEMS; LOGIC CIRCUITS; MOBILE SECURITY;

COMMUNICATION PROTOCOL SYSTEMS; EFFECTIVE MECHANISMS; FUZZ TESTING; INSTANT MESSAGING; PROTOCOL SPECIFICATIONS; SECURITY AND RELIABILITIES; SECURITY TESTING; TRACE MINIMIZATION;

NETWORK SECURITY;

EID: 45849102072     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-540-68855-6_19     Document Type: Conference Paper

References (12)

1. Angulin, D.: Learning regular sets from queries and counterexamples. Information and Computation 75, 87-106 (1987)
2. Cui, W., Kannan, J., Wang, H.: Discoverer: Automatic Protocol Reverse Engineering from Network Traces. In: The 16th USENIX Security Symposium (2007)
3. Dolev, D., Yao, A.: On the security of public-key protocols. IEEE Transaction on Information Theory 29, 198-208 (1983)
4. Godefroid, P., Klarlund, N., Sen, K.: DART: Directed Automated Random Testing. In: Proceedings of PLDI 2005 (ACM SIGPLAN 2005 Conference on Programming Language Design and Implementation), pp. 213-223 (2005)
5. Godefroid, P., Levin, M.Y., Molnar, D.: Automated Whitebox Fuzz Testing. Technical Report MS-TR-2007-58, Microsoft (May 2007)
6. Gören, S., Ferguson, F.J.: On state reduction of incompletely specified finite state machines. Computers and Electrical Engineering 33(1), 58-69 (2007)
7. Howard, M.: Inside the Windows Security Push. IEEE Security & Privacy, 57-61 (2003)
8. Lee, D., Yannakakis, M.: Principles and methods of testing finite state machines - A survey. In: Proceedings of the IEEE, 1090-1123 (1996)
9. Oehlert, P.: Violating Assumptions with Fuzzing. IEEE Security & Privacy, pp. 58-62 (2005)
10. Peled, D., Vardi, M.Y., Yannakakis, M.: Black-box checking. In: Proceedings of IFIP FORTE/PSTV (1999)
11. Shu, G., Lee, D.: Testing Security Properties of protocol implementations - a machine learning based approach. In: Proceedings of IEEE ICDCS (2007)
12. Wang, L., Ellis, C., Yin, W., Luong, D.D.: Hercules: An Environment for Large-Scale Enterprise Infrastructure Testing. In: Proceedings of the Workshop on Advances and Innovations in Systems Testing (2007)