Practical Applications of Probabilistic Model Checking to Communication Protocols

Duflot, Marie; Kwiatkowska, Marta; Norman, Gethin; Parker, David; Peyronnet, Sylvain; Picaronny, Claudine; Sproston, Jeremy

doi:10.1002/9781118459898.ch7

Cited by 21 publications

(16 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To reason about the correctness of network protocols, prior work has employed a variety of program analysis techniques, such as model checking [15], [21], [35], [41], [43], static analysis [16], [46], [49], theorem proving [50], and refinement checking [2].…”

Section: Related Workmentioning

confidence: 99%

<sc>SymbexNet</sc>: Testing Network Protocol Implementations with Symbolic Execution and Rule-Based Specifications

Song

Cadar

Pietzuch

2014

IIEEE Trans. Software Eng.

View full text Add to dashboard Cite

Implementations of network protocols, such as DNS, DHCP and Zeroconf, are prone to flaws, security vulnerabilities and interoperability issues caused by developer mistakes and ambiguous requirements in protocol specifications. Detecting such problems is not easy because (i) many bugs manifest themselves only after prolonged operation; (ii) reasoning about semantic errors requires a machine-readable specification; and (iii) the state space of complex protocol implementations is large. This article presents a novel approach that combines symbolic execution and rule-based specifications to detect various types of flaws in network protocol implementations. The core idea behind our approach is to (1) automatically generate high-coverage test input packets for a network protocol implementation using single-and multi-packet exchange symbolic execution (targeting stateless and stateful protocols, respectively) and then (2) use these packets to detect potential violations of manual rules derived from the protocol specification, and check the interoperability of different implementations of the same network protocol. We present a system based on these techniques, SYMBEXNET, and evaluate it on multiple implementations of two network protocols: Zeroconf, a service discovery protocol, and DHCP, a network configuration protocol. SYMBEXNET is able to discover non-trivial bugs as well as interoperability problems, most of which have been confirmed by the developers.

show abstract

Section: Related Workmentioning

confidence: 99%

<sc>SymbexNet</sc>: Testing Network Protocol Implementations with Symbolic Execution and Rule-Based Specifications

Song

Cadar

Pietzuch

2014

IIEEE Trans. Software Eng.

View full text Add to dashboard Cite

show abstract

“…PTAs have real-valued clocks and, like MDPs [24] and therefore allow us to model systems with a range of different characteristics (non-determinism, probability, and real time). In this section, we illustrate a number of basic PTA concepts using the example in Fig.…”

Section: A Probabilistic Timed Automatamentioning

confidence: 99%

Uncertainty analysis of phased mission systems with probabilistic timed automata

Peng

Miller

2016

2016 IEEE International Conference on Prognostics and Health Management (ICPHM)

View full text Add to dashboard Cite

Abstract-A phased mission is one in which the requirements may alter over time. We present a novel approach to analyse phased mission systems using probabilistic timed automata (PTA). We show how to construct PTA models which allow one to reflect system uncertainty, and how to analyse these models using the PRISM probabilistic model checker. We illustrate our approach via a simple case study, namely path planning for a Mars exploration rover, since the mission of the rover can be expected to be an instance of phased mission systems.

show abstract

“…Further, these models are analysed by specifying properties in PCTL, continuoustime stochastic logic (CSL) and linear temporal logic (LTL) logics and their extensions in terms of rewards [19]. The analysis of communication protocols is performed in [20] using probabilistic timed automata and probabilistic model checking. An overview of advantages and disadvantages of both techniques is also given.…”

Section: Prism Model Checkermentioning

confidence: 99%

Modelling and symmetry reduction of a target-tracking protocol using wireless sensor networks

Bhatti¹,

Memon²,

Jokhio³

et al. 2012

IET Commun.

View full text Add to dashboard Cite

To achieve precise modelling of real-time systems stochastic behaviours are considered which lead towards probabilistic modelling. Probabilistic modelling has been successfully employed in wide array of application domains including, for example, randomised distributed algorithms, communication, security and power management protocols. This study is an improvement over our previous work, which was based on the probabilistic analysis of a cluster-based fault tolerant target-tracking protocol (FTTT) using only grid-based sensor nodes arrangement. Probabilistic modelling is chosen for the analysis of FTTT protocol to facilitate benefits of symmetry reduction in conjunction with modelling. It is believed that for the first time correctness of the simplified version of a target-tracking protocol is verified by developing its continuous-time Markov chain (CTMC) model using symbolic modelling language. The proposed probabilistic model of a target-tracking wireless sensor networks will help to analyse the phases of FTTT protocol on a limited scale with finite utilisation of time. There are three main contributions of this study; first consideration of synchronised events between the modules, second, random placement of sensor nodes is taken into account in addition to grid-based sensor node arrangement, third one is the reduction in state space size through symmetry reduction technique, which also facilitates to analyse a larger size network. Symmetry reduction on Probabilistic Symbolic Model (PRISM) checker models is performed by PRISM-symm and the generic representatives in PRISM (GRIP) tool. Modelling of FTTT protocol is proved better with the usage of PRISM-symm after comparing the results of PRISM model, PRISM-symm and GRIP.

show abstract

Practical Applications of Probabilistic Model Checking to Communication Protocols

Cited by 21 publications

References 30 publications

<sc>SymbexNet</sc>: Testing Network Protocol Implementations with Symbolic Execution and Rule-Based Specifications

<sc>SymbexNet</sc>: Testing Network Protocol Implementations with Symbolic Execution and Rule-Based Specifications

Uncertainty analysis of phased mission systems with probabilistic timed automata

Modelling and symmetry reduction of a target-tracking protocol using wireless sensor networks

Contact Info

Product

Resources

About