Automated Attacker Synthesis for Distributed Protocols

Abstract

Distributed protocols should be robust to both benign malfunction (e.g. packet loss or delay) and attacks (e.g. message replay) from internal or external adversaries. In this paper we take a formal approach to the automated synthesis of attackers, i.e. adversarial processes that can cause the protocol to malfunction. Specifically, given a formal threat model capturing the distributed protocol model and network topology, as well as the placement, goals, and interface (inputs and outputs) of potential attackers, we automatically synthesize an attacker. We formalize four attacker synthesis problems -across attackers that always succeed versus those that sometimes fail, and attackers that attack forever versus those that do not -and we propose algorithmic solutions to two of them. We report on a prototype implementation called KORG and its application to TCP as a case-study. Our experiments show that KORG can automatically generate well-known attacks for TCP within seconds or minutes.

NetPlier: Probabilistic Network Protocol Reverse Engineering from Message Traces

“…For example, autonomous vehicles utilize CAN bus and FlexRay, control systems use Modbus and DNP3, online chatting/conferencing applications have their customized protocols. Many security analysis such as static/symbolic vulnerability scanning [40], [24], exploit generation [79], [19], fuzzing [65], [43], [44], [31], attack detection [15], [29], and malware behavior analysis [75], [18] require precise modeling of the network protocol. For instance, knowing the protocol of a networking application is critical to seed input generation in fuzzing; malware analysis often requires composing well-formed messages to the Command and Control (C&C) server so that hidden behaviors can be triggered by the appropriate server responses [23], [83]; and static/symbolic analysis needs to properly model networking functions otherwise a lot of false positives may be generated.…”

Synthesis of Winning Attacks on Communication Protocols using Supervisory Control Theory: Two Case Studies

“…As protection against attacks is one of the main subjects of systems security, methodologies for designing attack strategies against systems have been reported in the literature [16,17,18]. [16] presents how to synthesize an attacker in the context of stealthy deception attacks, modeled in the framework of SCT, which cannot be detected by the supervisor and cause damage to the system, as a counter weapon against intrusion detection modules as in [12].…”

“…Formal synthesis of successful attacks against protocols is the problem considered in this paper. The work in [18] (and its conference version [19]) is of special relevance, as it introduces a methodology of attacker synthesis against systems whose components are modeled as finite-state automata (FSA). It presents how so-called "T -" attackers can be found (if they exist) using a formal methodology that has been implemented in the software tool K [20].…”

“…It presents how so-called "T -" attackers can be found (if they exist) using a formal methodology that has been implemented in the software tool K [20]. In the terminology of [18], "T -" refers to attackers that cannot always lead protocols to a violation of required properties, but sometimes succeed ("there exists" a winning run for the attacker). [18] formulates the properties that protocols must protect against as threat models, and it illustrates its methodology with the Transmission Control Protocol (TCP), as standardized in [21].…”

“…In the terminology of [18], "T -" refers to attackers that cannot always lead protocols to a violation of required properties, but sometimes succeed ("there exists" a winning run for the attacker). [18] formulates the properties that protocols must protect against as threat models, and it illustrates its methodology with the Transmission Control Protocol (TCP), as standardized in [21]. The formal model in [18] was inspired by that in [22] where automated attack discovery is performed using a state-machine-informed search.…”