Generating models of infinite-state communication protocols using regular inference with abstraction

Abstract

Abstract. In order to facilitate model-based verification and validation, effort is underway to develop techniques for generating models of communication system components from observations of their external behavior. Most previous such work has employed regular inference techniques which generate modest-size finite-state models. They typically suppress parameters of messages, although these have a significant impact on control flow in many communication protocols. We present a framework, which adapts regular inference to include data parameters in messages and states for generating components with large or infinite message alphabets. A main idea is to adapt the framework of predicate abstraction, successfully used in formal verification. Since we are in a black-box setting, the abstraction must be supplied externally, using information about how the component manages data parameters. We have implemented our techniques by connecting the LearnLib tool for regular inference with the protocol simulator ns-2, and generated models of SIP and TCP components as implemented in ns-2.

Model-Based Testing IoT Communication via Active Automata Learning

“…Firstly, we need to account for dependencies between clients. Unlike in pure client/serversettings, like in the TLS protocol [18] or the TCP [3], [21], it is not sufficient to simulate one client to adequately infer a model of the server/broker in MQTT. We need to control multiple clients and record the messages each one has received.…”

“…This, however, is a general problem of active automata learning in the MAT framework and an issue for learning almost all non-trivial systems. To deal with this problem, we introduce a mapper component performing abstraction and concretisation [2], [3], [27]. However, unlike in the cited work, we do not refine our abstractions in an iterative manner, but rather use a static mapper throughout the learning phase.…”

Active learning for extended finite state machines

“…Other approaches use AAL to infer data constraints from tests: In [AJUV14], a manually supplied abstraction on the data domain makes it possible to apply finite-state active automata learning techniques to the test cases. The approach has been successfully used in practical applications [ASV10,AdRP13], but a drawback is that a priori insight into the target component's behavior is required, making it not quite black-box.…”

“…However, there is still no general dynamic analysis technique for inferring EFSM models with guards and assignments to variables. Existing techniques have restrictions: some limit the available operations on data to comparisons for equality, while others require significant manual effort (e.g., [AJUV14]), and/or rely on access to source code (e.g., [BB13]). …”

Learning Device Models with Recurrent Neural Networks

“…Variations of this algorithm are in use today [8] [6], and are applied to such areas as hardware and software component testing [9], formal model verification [10], hardware reverse engineering [4], and network protocol inference [11]. Recently, work has begun on learning register automata, which allows a memory stack within the learned automata [12], which may improve performance.…”