SFADiff: Automated evasion attacks and fingerprinting using black-box differential automata learning

Proceedings of the ACM Conference on Computer and Communications Security

Volumn 24-28-October-2016, Issue , 2016, Pages 1690-1701

  Argyros, George ^a   Stais, Ioannis ^b   Jana, Suman ^a   Keromytis, Angelos D ^a   Kiayias, Aggelos ^c  

^a Howard Hughes Medical Institute   (United States)

^b UNIVERSITY OF ATHENS   (Greece)

^c UNIVERSITY OF EDINBURGH   (United Kingdom)

Author keywords

[No Author keywords available]

Indexed keywords

APPLICATION PROGRAMS; COMPUTER SYSTEM FIREWALLS; COMPUTER VIRUSES; HTML; TESTING; WEB BROWSERS;

CROSS SITE SCRIPTING ATTACKS; DIFFERENTIAL TESTING; DOMAIN INDEPENDENTS; INTERNET EXPLORERS; MODEL BASED APPROACH; ROOT CAUSE ANALYSIS; SECURITY PROBLEMS; WEB APPLICATION FIREWALLS;

BLACK-BOX TESTING;

EID: 84995519560     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2976749.2978383     Document Type: Conference Paper

References (32)

1. Peach fuzzer. http://www.peachfuzzer.com/. (Accessed on 08/10/2016).
2. F. Aarts, J. D. Ruiter, and E. Poll. Formal models of bank cards for free. In Software Testing, Verification and Validation Workshops (ICSTW), IEEE International Conference on, 2013.
3. F. Aarts, J. Schmaltz, and F. Vaandrager. Inference and abstraction of the biometric passport. In Leveraging Applications of Formal Methods, Verification, and Validation. 2010.
4. D. Angluin. Learning regular sets from queries and counterexamples. Information and computation, 75(2):87-106, 1987.
5. G. Argyros, I. Stais, A. Keromytis, and A. Kiayias. Back in black: Towards formal, black-box analysis of sanitizers and filters. In Security and privacy (S&P), 2016 IEEE symposium on, 2016.
6. J. Balcázar, J. Díáz, R. Gavalda, and O. Watanabe. Algorithms for learning finite automata from queries: A unified view. Springer, 1997.
7. ∗: Symbolic Learning of Input-Output Specifications. In POPL, 2013.
8. C. Brubaker, S. Jana, B. Ray, S. Khurshid, and V. Shmatikov. Using frankencerts for automated adversarial testing of certificate validation in SSL/TLS implementations. In Security and privacy (S&P), 2016 IEEE symposium on, 2014.
9. D. Brumley, J. Caballero, Z. Liang, J. Newsome, and D. Song. Towards automatic discovery of deviations in binary implementations with applications to error detection and fingerprint generation. In USENIX Security Symposium (USENIX Security), 2007.
10. J. Caballero, S. Venkataraman, P. Poosankam, M. Kang, D. Song, and A. Blum. FiG: Automatic fingerprint generation. Department of Electrical and Computing Engineering, page 27, 2007.
11. Y. Chen, T. Su, C. Sun, Z. Su, and J. Zhao. Coverage-directed differential testing of JVM implementations. In Proceedings of the 37th ACM SIGPLAN Conference on Programming Language Design and Implementation, pages 85-99. ACM, 2016.
12. T. Chow. Testing software design modeled by finite-state machines. IEEE transactions on software engineering, (3): 178-187, 1978.
13. T. H. Cormen. Introduction to algorithms. MIT press, 2009.
14. L. D'Antoni and M. Veanes. Minimization of symbolic automata. In ACM SIGPLAN Notices, volume 49, pages 541-553. ACM, 2014.
15. P. Fiteräu-Brostean, R. Janssen, and F. Vaandrager. Learning fragments of the TCP network protocol. In Formal Methods for Industrial Critical Systems. 2014.
16. P. Fiteráu-Brostean, R. Janssen, and F. Vaandrager. Combining model learning and model checking to analyze TCP implementations. In International Conference on Computer-Aided Verification (CAV). 2016.
17. Fyodor. Remote OS detection via TCP/IP fingerprinting (2nd generation).
18. A. Groce, G. Holzmann, and R. Joshi. Randomized differential testing as a prelude to formal verification. In International Conference on Software Engineering (ICSE), 2007.
19. A. Groce, D. Peled, and M. Yannakakis. Adaptive model checking. In Tools and Algorithms for the Construction and Analysis of Systems, pages 357-370. 2002.
20. J. Jung, A. Sheth, B. Greenstein, D. Wetherall, G. Maganis, and T. Kohno. Privacy oracle: a system for finding application leaks with black box differential testing. In CCS, 2008.
21. D. Kozen. Lower bounds for natural proof systems. In FOCS, 1977.
22. F. Massicotte and Y. Labiche. An analysis of signature overlaps in Intrusion Detection Systems. In IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), 2011.
23. W. McKeeman. Differential testing for software. Digital Technical Journal, 10(1), 1998.
24. H. Raffelt, B. Steffen, and T. Berg. Learnlib: A library for automata learning and experimentation. In Proceedings of the 10th international workshop on Formal methods for industrial critical systems (FMICS), 2005.
25. D. Richardson, S. Gribble, and T. Kohno. The limits of automatic OS fingerprint generation. In ACM workshop on Artificial intelligence and security (AISec), 2010.
26. J. D. Ruiter and E. Poll. Protocol state fuzzing of TLS implementations. In USENIX Security Symposium (USENIX Security), 2015.
27. G. Shu and D. Lee. Network Protocol System Fingerprinting-A Formal Approach. In IEEE Conference on Computer Communications (INFOCOM), 2006.
28. M. Sipser. Introduction to the Theory of Computation, volume 2. Thomson Course Technology Boston, 2006.
29. M. Veanes, P. D. Halleux, and N. Tillmann. Rex: Symbolic regular expression explorer. In International Conference on Software Testing, Verification and Validation (ICST), 2010.
30. M. Veanes, P. Hooimeijer, B. Livshits, D. Molnar, and N. Bjorner. Symbolic finite state transducers: Algorithms and applications. ACM SIGPLAN Notices, 47, 2012.
31. W. Xu, Y. Qi, and D. Evans. Automatically evading classifiers a case study on PDF malware classifiers. In Proceedings of the 2016 Network and Distributed Systems Symposium (NDSS), 2016.
32. X. Yang, Y. Chen, E. Eide, and J. Regehr. Finding and understanding bugs in C compilers. In PLDI, 2011.