MACE: Model-inference-assisted concolic exploration for protocol and vulnerability discovery

Proceedings of the 20th USENIX Security Symposium

Volumn , Issue , 2011, Pages 139-154

  Cho, Chia Yuan ^a,c   Babić, Domagoj ^a   Poosankam, Pongsin ^a,b   Chen, Kevin Zhijie ^a   Wu, Edward Xuejun ^a   Song, Dawn ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

^b CARNEGIE MELLON UNIVERSITY   (United States)

^c DSO NATIONAL LABORATORIES   (Singapore)

Author keywords

[No Author keywords available]

Indexed keywords

SCAFFOLDS; SPACE RESEARCH; VERIFICATION;

ABSTRACT MODELING; MODEL INFERENCE; NOVEL TECHNIQUES; PROGRAM STATE; SEARCH PROCESS; SOFTWARE SECURITY; STATE SPACE EXPLORATION; VULNERABILITY DISCOVERY;

SOFTWARE TESTING;

EID: 85071952998     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (30)

1. ANGLUIN, D. Learning regular sets from queries and counterexamples. Information and Computation 75, 2 (1987), 87-106.
2. BALL, T., MAJUMDAR, R., MILLSTEIN, T., AND RAJAMANI, S. Automatic Predicate Abstraction of C Programs. In PLDI'01: Proc. of the ACM SIGPLAN 2001 Conf. on Programming Language Design and Implementation (2001), vol. 36 of ACM SIGPLAN Notices, ACM Press, pp. 203-213.
3. BARNETT, M., DELINE, R., F ÄHNDRICH, M., JACOBS, B., LEINO, K. R., SCHULTE, W., AND VENTER, H. Verified software: Theories, tools, experiments. Springer-Verlag, 2008, ch. The Spec# Programming System: Challenges and Directions, pp. 144-152.
4. BENZEL, T., BRADEN, R., KIM, D., NEUMAN, C., JOSEPH, A., SKLOWER, K., OSTRENGA, R., AND SCHWAB, S. Design, deployment, and use of the DETER testbed. In Proc. of the DETER Community Workshop on Cyber Security Experimentation and Test on DETER Community Workshop on Cyber Security Experimentation and Test (2007), USENIX Association.
5. CABALLERO, J., POOSANKAM, P., KREIBICH, C., AND SONG, D. Dispatcher: Enabling active botnet infiltration using automatic protocol reverse-engineering. In CCS'09: Proc. of the 16th ACM conference on Computer and communications security (2009), ACM, pp. 621-634.
6. CABALLERO, J., YIN, H., LIANG, Z., AND SONG, D. Polyglot: Automatic extraction of protocol message format using dynamic binary analysis. In CCS'07: Proc. of the 14th ACM Conf. on Computer and Communications Security (2007), ACM, pp. 317-329.
7. CADAR, C., DUNBAR, D., AND ENGLER, D. KLEE: Unassisted and automatic generation of high-coverage tests for complex systems programs. In OSDI'08: Proc. of the 8th USENIX Symposium on Operating Systems Design and Implementation (2008), USENIX Association, pp. 209-224.
8. CADAR, C., AND ENGLER, D. R. Execution generated test cases: How to make systems code crash itself. In SPIN'05: Proc. of the 12th Int. SPIN Workshop on Model Checking Software (2005), vol. 3639 of Lecture Notes in Computer Science, Springer, pp. 2-23.
9. CADAR, C., GANESH, V., PAWLOWSKI, P. M., DILL, D. L., AND ENGLER, D. R. Exe: Automatically generating inputs of death. ACM Trans. Inf. Syst. Secur. 12 (2008), 1-38.
10. CHO, C. Y., BABIĆ, D., SHIN, R., AND SONG, D. Inference and analysis of formal models of botnet command and control protocols. In CCS'10: Proc. of the 2010 ACM Conf. on Computer and Communications Security (2010), ACM, pp. 426-440.
11. CHO, C. Y., CABALLERO, J., GRIER, C., PAXSON, V., AND SONG, D. Insights from the inside: A view of botnet management from infiltration. In LEET'10: Proc. of the 3rd USENIX Workshop on Large-Scale Exploits and Emergent Threats (2010), USENIX Association, pp. 1-1.
12. COMPARETTI, P. M., WONDRACEK, G., KRUEGEL, C., AND KIRDA, E. Prospex: Protocol specification extraction. In S&P'09: Proc. of the 2009 30th IEEE Symposium on Security and Privacy (2009), IEEE Computer Society, pp. 110-125.
13. CORMEN, T. H., LEISERSON, C. E., RIVEST, R. L., AND STEIN, C. Introduction to Algorithms, 2nd ed. The MIT Press, 2001.
14. CUI, W., KANNAN, J., AND WANG, H. J. Discoverer: Automatic protocol reverse engineering from network traces. In Proc. of 16th USENIX Security Symposium (2007), USENIX Association, pp. 1-14.
15. CUI, W., PEINADO, M., CHEN, K., WANG, H. J., AND IRÚN-BRIZ, L. Tupni: Automatic reverse engineering of input formats. In CCS'08: Proc. of the 15th ACM Conf. on Computer and Communications Security (2008), ACM, pp. 391-402.
16. DE LA HIGUERA, C. Grammatical Inference: Learning Automata and Grammars. Cambridge University Press, 2010.
17. GODEFROID, P., KLARLUND, N., AND SEN, K. DART: Directed automated random testing. In PLDI'05: Proc. of the ACMSIGPLAN Conf. on Programming Language Design and Implementation (2005), ACM, pp. 213-223.
18. GODEFROID, P., LEVIN, M. Y., AND MOLNAR, D. A. Automated whitebox fuzz testing. In NDSS'08: Proc. of the Network and Distributed System Security Symposium (2008), The Internet Society.
19. GULAVANI, B. S., HENZINGER, T. A., KANNAN, Y., NORI, A. V., AND RAJAMANI, S. K. SYNERGY: A new algorithm for property checking. In FSE'06: Proc. of the 14th ACM SIGSOFT Int. Symp. on Foundations of Software Engineering (2006), ACM, pp. 117-127.
20. HENZINGER, T. A., JHALA, R., MAJUMDAR, R., AND SUTRE, G. Software Verification with Blast. In SPIN'03: Proc. of the 10th Int. Workshop on Model Checking of Software (2003), vol. 2648 of LNCS, Springer-Verlag, pp. 235-239.
21. HO, P. H., SHIPLE, T., HARER, K., KUKULA, J., DAMIANO, R., BERTACCO, V., TAYLOR, J., AND LONG, J. Smart simulation using collaborative formal and simulation engines. In ICCAD'00: Proc. of the 2000 IEEE/ACM Int. Conf. on Computer-aided design (2000), IEEE Press, pp. 120-126.
22. KING, J. C. Symbolic execution and program testing. Communications of the ACM 19, 7 (1976), 385-394.
23. MEALY, G. H. A method for synthesizing sequential circuits. Bell System Technical Journal 34, 5 (1955), 1045-1079.
24. PELED, D., VARDI, M. Y., AND YANNAKAKIS, M. Black box checking. In Proc. of the IFIP TC6 WG6.1 Joint Int. Conf. on Formal Description Techniques for Distributed Systems and Communication Protocols (FORTE XII) and Protocol Specification, Testing and Verification (PSTV XIX) (1999), Kluwer, B.V., pp. 225-240.
25. SEN, K., MARINOV, D., AND AGHA, G. Cute: A concolic unit testing engine for c. SIGSOFT Softw. Eng. Notes 30 (2005), 263-272.
26. SHAHBAZ, M., AND GROZ, R. Inferring Mealy machines. In FM'09: Proc. of the 2nd World Congress on Formal Methods (2009), Springer, pp. 207-222.
27. VEANES, M., CAMPBELL, C., GRIESKAMP, W., SCHULTE, W., TILLMANN, N., AND NACHMANSON, L. Formal methods and testing. Springer-Verlag, 2008, ch. Model-based testing of object-oriented reactive systems with spec explorer, pp. 39-76.
28. VILAR, J. M. Query learning of subsequential transducers. In Proc. of the 3rd Int. Colloquium on Grammatical Inference: Learning Syntax from Sentences (1996), Springer-Verlag, pp. 72-83.
29. WANG, Z., JIANG, X., CUI, W., WANG, X., AND GRACE, M. ReFormat: Automatic reverse engineering of encrypted messages. In ESORICS'09: 14th European Symposium on Research in Computer Security (2009), vol. 5789 of Lecture Notes in Computer Science, Springer, pp. 200-215.
30. ZHANG, L., MADIGAN, C. F., MOSKEWICZ, M. H., AND MALIK, S. Efficient conflict driven learning in a boolean satisfiability solver. In ICCAD'01: Proc. of the Int. Conf. on Computer-Aided Design (2001), IEEE Press, pp. 279-285.