Prospex: Protocol specification extraction

Proceedings - IEEE Symposium on Security and Privacy

Volumn , Issue , 2009, Pages 110-125

  Comparetti, Paolo Milani ^a   Wondracek, Gilbert ^a   Kruegel, Christopher ^b   Kirda, Engin ^c  

^a VIENNA UNIVERSITY OF TECHNOLOGY   (Austria)

^b UNIVERSITY OF CALIFORNIA   (United States)

^c EURECOM   (France)

Author keywords

[No Author keywords available]

Indexed keywords

BEHAVIOR-BASED; BLACK BOXES; COMMAND AND CONTROL; DEEP PACKET INSPECTION; HUMAN INTERACTIONS; MESSAGE FORMAT; NETWORK TRAFFIC; PROTOCOL MESSAGE; PROTOCOL SPECIFICATIONS; REAL-WORLD; REAL-WORLD APPLICATION; REVERSE ENGINEERS; SECURITY VULNERABILITIES; SERVER BEHAVIOR; STATE MACHINE;

CONTOUR FOLLOWERS; INTERNET; NETWORK PROTOCOLS; REENGINEERING; REVERSE ENGINEERING; SPECIFICATIONS;

NETWORK SECURITY;

EID: 70350402293     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2009.14     Document Type: Conference Paper

References (66)

1. P. Oehlert, "Violating Assumptions with Fuzzing," IEEE Security and Privacy, vol.3, no.2, 2005.
2. R. Kaksonen, M. Laakso, and A. Takanen, "Software Security Assessment through Specification Mutations and Fault Injection," in IFIP Joint Working Conference on Communications and Multimedia Security (CMS), 2001.
3. V. Paxson, "Bro: A System for Detecting Network Intruders in Real-Time," in Usenix Security Symposium, 1998.
4. R. Pang, V. Paxson, R. Sommer, and L. Peterson, "binpac: A yacc for writing application protocol parsers," in Internet Measurement Conference (IMC), 2006.
5. N. Borisov, D. Brumley, H. J. Wang, J. Dunagan, P. Joshi, and C. Guo, "A Generic Application-Level Protocol Analyzer and its Language," in 14th Symposium on Network and Distributed System Security (NDSS), 2007.
6. S. Venkataraman, J. Caballero, P. Poosankam, M. Kang, and D. Song, "Fig: Automatic Fingerprint Generation," in Symposium on Network and Distributed System Security (NDSS), 2007.
7. D. Brumley, J. Caballero, Z. Liang, J. Newsome, and D. Song, "Towards Automatic Discovery of Deviations in Binary Implementations with Applications to Error Detection and Fingerprint Generation," in Usenix Security Symposium, 2007.
8. D. Dagon, G. Gu, C. Lee, and W. Lee, "A Taxonomy of Botnet Structures," in Annual Computer Security Applications Conference (ACSAC), 2007.
9. P. Porras, H. Saidi, and V. Yegneswaran, "A Multi-perspective Analysis of the Storm (Peacomm) Worm," Computer Science Laboratory, SRI International, Tech. Rep., 2007.
10. "Danmec / Asprox SQL Injection Attack Tool Analysis," http://www.secureworks.com/research/threats/danmecasprox/?threat=danmecasprox, 2008.
11. W. Cui, J. Kannan, and H. Wang, "Discoverer: Automatic Protocol Reverse Engineering from Network Traces," in 16th Usenix Security Symposium, 2007.
12. W. Cui, V. Paxson, N. Weaver, and R. Katz, "Protocol- Independent Adaptive Replay of Application Dialog," in 13th Symposium on Network and Distributed System Security (NDSS), 2006.
13. C. Leita, M. Dacier, and F. Massicotte, "Automatic Handling of Protocol Dependencies and Reaction to 0-Day Attacks with ScriptGen-based Honeypots," in Symposium on Recent Advances in Intrusion Detection (RAID), 2006.
14. C. Leita, K. Mermoud, and M. Dacier, "ScriptGen: An Automated Script Generation Tool for Honeyd," in 21st Annual Computer Security Applications Conference (ACSAC), 2005.
15. J. Caballero, H. Yin, Z. Liang, and D. Song, "Polyglot: Automatic Extraction of Protocol Format using Dynamic Binary Analysis," in 14th ACM Conference on Computer and Communications Security (CCS), 2007.
16. Z. Lin, X. Jiang, D. Xu, and X. Zhang, "Automatic Protocol Format Reverse Engineering through Context-Aware Monitored Execution," in 15th Symposium on Network and Distributed System Security (NDSS), 2008.
17. G. Wondracek, P. Milani Comparetti, C. Kruegel, and E. Kirda, "Automatic Network Protocol Analysis," in 15th Symposium on Network and Distributed System Security (NDSS), 2008.
18. W. Cui, M. Peinado, K. Chen, H. Wang, and L. Irun-Briz, "Tupni : Automatic Reverse Engineering of Input Formats," in ACM Conference on Computer and Communications Security (CCS), 2008.
19. "Peach Fuzzing Platform," http://peachfuzzer.com, 2008.
20. L. Kaufman and P. Rousseeuw, Finding Groups in Data: An Introduction to Cluster Analysis. Wiley, 1990.
21. K. J. Lang, "Faster Algorithms for Finding Minimal Consistent DFAs," NEC Research Institute, Tech. Rep., 1999.
22. J. Chow, B. Pfaff, T. Garfinkel, K. Christopher, and M. Rosenblum, "Understanding Data Lifetime via Whole System Simulation," in Usenix Security Symposium, 2004.
23. M. Costa, J. Crowcroft, M. Castro, A. Rowstron, L. Zhou, L. Zhang, and P. Barham, "Vigilante: End-to-End Containment of Internet Worms," in 20th ACM Symposium on Operating Systems Principles (SOSP), 2005.
24. J. Crandall and F. Chong, "Minos: Control Data Attack Prevention Orthogonal to Memory Model," in 37th International Symposium on Microarchitecture (MICRO), 2004.
25. Z. Wang, X. Jiang, W. Cui, and X. Wang, "ReFormat: Automatic Reverse Engineering of Encrypted Messages," NC State University, Tech. Rep. 2008-26, 2008.
26. S. Needleman and C.Wunsch, "A General Method Applicable to the Search for Similarities in the Amino Acid Sequence of Two Proteins," Journal of Molecular Biology, vol.48, no.3, 1970.
27. P. Jaccard, "The Distribution of Flora in the Alpine Zone," The New Phytologist, vol.11, no.2, pp. 37-50, 1912.
28. J. Dunn, "Well Separated Clusters and Optimal Fuzzy Partitions," Journal of Cybernetics, vol.4, 1974.
29. N. R. Pal and J. Biswas, "Cluster Validation Using Graph Theoretic Concepts," Pattern Recognition, vol.30, no.6, 1997.
30. E. M. Gold, "Language Identification in the Limit," Information and Control, vol.10, no.5, 1967.
31. M. Bugalho and A. L. Oliveira, "Inference of Regular Languages Using State Merging Algorithms with Search," Pattern Recognition, vol.38, no.9, 2005.
32. E. M. Gold, "Complexity of Automaton Identification from Given Data," Information and Control, vol.37, no.3, 1978.
33. B. Miller, L. Fredriksen, and B. So, "An Empirical Study of the Reliability of UNIX Utilities," Communications of the ACM, vol.33, no.12, 1990.
34. M. Sutton, A. Greene, and P. Amini, Fuzzing: Brute Force Vulnerability Discovery, 1st ed. Addison-Wesley, 2007.
35. G. Banks, M. Cova, V. Felmetsger, K. Almeroth, R. Kemmerer, and G. Vigna, "Snooze: Toward a Stateful Network Protocol Fuzzer," in Proceedings of the 9th Information Security Conference (ISC), 2006.
36. T. Holz, "A Short Visit to the Bot Zoo [Malicious Bots Software]," Security & Privacy, IEEE, vol.3, no.3, 2005.
37. "RFC 3261 - SIP: Session Initiation Protocol," http://www.ietf.org/rfc/rfc3261.txt, 2008.
38. "Asterisk: The Open Source PBX and Telephony Platform," http://www.asterisk.org, 2008.
39. "X-Lite softphone," http://www.counterpath.com, 2008.
40. "Ekiga - Free your speech," http://www.ekiga.org, 2008.
41. "The Linux Desktop Testing Project," http://ldtp.freedesktop. org, 2008.
42. Wietse Venema, "Postfix," http://www.postfix.org, 2008.
43. C. Wallace and M. Georgeff, "A General Objective for Inductive Inference," Department of Computer Science, Monash University, Tech. Rep., 1983.
44. J. Patrick and P. North, "The sk-strings Method for Inferring PFSA," in Workshop on Automata Induction, Grammatical Inference and Language Acquisition at the 14th International Conference on Machine Learning (ICML97), 1997.
45. G. Ammons, R. Bodík, and J. R. Larus, "Mining Specifications," SIGPLAN Not., vol.37, no.1, 2002.
46. A. Raman, P. Andreae, and J. Patrick, "A Beam Search Algorithm for PFSA Inference," Pattern Analysis and Applications, vol.1, 1998.
47. "PFSA Toolkit," http://www.cs.usyd.edu.au/-rcdmnl/PFSA.
48. D. Lo and S. Khoo, "QUARK: Empirical Assessment of Automaton-based Specification Miners," in 13th Working Conference on Reverse Engineering (WCRE). IEEE Computer Society, 2006.
49. K. J. Lang, B. A. Pearlmutter, and R. A. Price, "Results of the Abbadingo One DFA Learning Competition and a New Evidence-Driven State Merging Algorithm," in ICGI 98: Proceedings of the 4th International Colloquium on Grammatical Inference. Springer-Verlag, 1998.
50. "Potential Arbitrary File Access," http://www.securityfocus. com/archive/1/377618, 2004.
51. "Asterisk DOS Vulnerability," http://secunia.com/advisories/ 24579, 2007.
52. A. Fritzler, "UnOfficial AIM/OSCAR Protocol Specification," http://www.oilcan.org/oscar/, 2007.
53. "How Samba Was Written," http://samba.org/ftp/tridge/misc/ french-cafe.txt, 2007.
54. M. Beddoe, "The Protocol Informatics Project," in Toorcon, 2004.
55. J. Whaley, M. C. Martin, and M. S. Lam, "Automatic Extraction of Object-Oriented Component Interfaces," SIGSOFT Softw. Eng. Notes, vol.27, no.4, 2002.
56. D. Engler, D. Chen, S. Hallem, A. Chou, and B. Chelf, "Bugs as Deviant Behavior: A General Approach to Inferring Errors in Systems Code," in ACM Symposium on Operating Systems Principles, 2001.
57. J. Yang and D. Evans, "Perracotta: Mining Temporal API Rules from Imperfect Traces," in 28th Internl. Conf. on Software Engineering (ICSE 2006).
58. R. Alur, P. Černý, P. Madhusudan, and W. Nam, "Synthesis of Interface Specifications for Java Classes," SIGPLAN Not., vol.40, no.1, 2005.
59. D. Angluin, "Learning Regular Sets from Queries and Counterexamples," Inf. Comput., vol.75, no. 2, 1987.
60. K. Sen, D. Marinov, and G. Agha, "CUTE: A Concolic Unit Testing Engine for C," in ESEC/FSE-13: Proceedings of the 10th European Software Engineering Conference held jointly with 13th ACM SIGSOFT International Symposium on Foundations of Software Engineering. ACM, 2005.
61. P. Godefroid, M. Y. Levin, and D. A. Molnar, "Automated Whitebox Fuzz Testing," in Network and Distributed Security Symposium (NDSS). Internet Society, 2008.
62. P. Godefroid, A. Kieżun, and M. Y. Levin, "Grammar-based Whitebox Fuzzing," in ACM SIGPLAN Conference on Programming Language Design and Implementation, 2008.
63. C. Cadar, V. Ganesh, P. M. Pawlowski, D. L. Dill, and D. R. Engler, "EXE: Automatically Generating Inputs of Death," in 13th ACM Conference on Computer and Communications Security (CCS), 2006.
64. C. Cadar, D. Dunbar, and D. R. Engler, "KLEE: Unassisted and Automatic Generation of High-Coverage Tests for Complex Systems Programs," in USENIX Symposium on Operating Systems Design and Implementation (OSDI), 2008.
65. J. Yang, C. Sar, P. Twohey, C. Cadar, and D. Engler, "Automatically Generating Malicious Disks Using Symbolic Execution," in IEEE Security and Privacy, 2006.
66. R. M. Karp, ""Reducibility Among Combinatorial Problems"," in Complexity of Computer Computations. Plenum Press, 1972.