Effective Security Testing of Network Protocol Implementations

Network protocols form the foundation of secure communication, and are used ubiquitously in modern societies.

Since security vulnerabilities and other software errors inside protocol implementations can have significant negative consequences, it is of vital importance to develop effective methods and tools to detect and correct these errors before malicious attackers find them.The aim of this project is to extend the state-of-the-art in the area of testing and verification of network protocol implementations, focusing on algorithms for effective state machine inference and on extending the power of techniques for protocol state fuzzing and testing of stateful programs.Starting from recent work by our group, published in top security conferences, we intend to:develop novel register automata learning algorithms capable of inferring state machine models of protocol implementations in great detail;employ the inferred models to automatically detect state machine errors, security vulnerabilities and attacks of protocol implementations; anduse the state machine models to significantly entend the power of stateful grey-box fuzzing techniques.On the practical side, we plan to:integrate the above in publicly available tools;evaluate our techniques on implementations of widely-used security protocols (improving their robustness and security in the process); anddevelop methodologies and recommendations for the effective use of these tools by network protocol designers and implementors.