EAGER: Improving Protocol Vulnerability Discovery via Semantic Interpretation of Textual Specifications

用于网络协议中漏洞发现的两种方法是测试和称为模型检查的半自动技术。 网络协议的测试和模型检查实现是一项繁琐且耗时的任务，其中大量的手动工作用于设计测试用例和协议属性规范。这两种方法都需要有关测试协议的详细和结构化的信息，以消息、状态机、不变量等形式，大多数情况下，这些信息是由具有不同专业知识水平的人手动获得的。通过利用有关这些协议的文档和规范并以文本格式提供，可以使该过程更有效且更便宜。自动分析文本规范形式的文档中可用的信息将不仅为改进网络协议的漏洞发现，而且为一般的软件设计开辟新的途径。该项目结合了自然语言处理和网络安全的专业知识，通过利用文本规范的语义解释，自动攻击生成和注入以及软件实现的属性模型检查，创建和构建网络协议中漏洞发现的框架。 该框架包括两个阶段，即知识积累阶段和脆弱性发现阶段。在知识构建阶段，语义解释自然语言处理技术应用于结构化文本（协议规范和文档）和非结构化文本（博客、论坛和bug报告），了解有关协议的结构化信息，例如：消息格式、协议状态机、约束等。在第二阶段，在知识阶段中学习的信息被应用于两种用于脆弱性发现的机制，第一种使用结构化协议信息来创建和注入攻击，第二种方法使用相同的信息来导出协议要求，并使用它们来对从协议实现中提取的有限状态机进行模型检查。

Two methods used for vulnerability discovery in network protocols are testing and a semi-automated technique called model checking. Testing and model checking implementations of network protocols is a tedious and time-consuming task, where significant manual effort goes into designing test cases and protocol property specifications. Both approaches require detailed and structured information about the tested protocols, in the form of messages, state machine, invariants, etc. Most of the time this information is derived manually by people with different levels of expertise. The process can be made more effective and less expensive by leveraging documentation and specification about these protocols and available in text format. Automatically analyzing the information available in documentations in the form of textual specification will open new avenues not only for improving vulnerability finding for network protocols, but for software design in general. This project combines expertise from natural language processing and network security to create and build a framework for vulnerability discovery in network protocols, by leveraging semantic interpretation of textual specification, automated attack generation and injection, and property model checking for software implementations. The framework consists of two phases, a knowledge building phase and a vulnerability finding phase. In the knowledge building phase, semantic interpretation natural language processing techniques is applied to structured text (protocol specifications and documentation) and unstructured text (blogs, forums, and bug reports) to learn structured information about protocols such as: message formats, protocol state machine, constraints, etc. In the second phase, the information learned in the knowledge phase is applied to two mechanisms for vulnerability finding, the first uses the structured protocol information to create and inject attacks, and the second uses the same information to derive protocol requirements and use them to model check finite state machines extracted from protocol implementations.