The Closer You Look, The More You Learn

Stone, Chris McMahon; Thomas, Samuel W.; Vanhoef, Mathy; Henderson, James; Bailluet, Nicolas; Chothia, Tom

doi:10.1145/3548606.3559365

Cited by 7 publications

(2 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Based on the work by Doupé et al [17], Borcherding. et al [18] present a generic framework for state machine inference in black box testing of web applications.Gascon et al [19] train a Markov Chain representing the states of a network protocol and use this knowledge to guide the fuzzing process.McMahon Stone et al [20] automatically learn a protocol state machine in a gray box setting.However, these approaches learn an explicit model of the SUT, which is then used to explicitly guide the fuzzing process. In contrast, we aim to learn an implicit representation of the SUT's behavior.…”

Section: Related Workmentioning

confidence: 99%

Smarter Evolution: Enhancing Evolutionary Black Box Fuzzing with Adaptive Models

Borcherding,

Morawetz,

Pfrang

2023

Sensors

View full text Add to dashboard Cite

Smart production ecosystems are a valuable target for attackers. In particular, due to the high level of connectivity introduced by Industry 4.0, attackers can potentially attack individual components of production systems from the outside. One approach to strengthening the security of industrial control systems is to perform black box security tests such as network fuzzing. These are applicable, even if no information on the internals of the control system is available. However, most security testing strategies assume a gray box setting, in which some information on the internals are available. We propose a new approach to bridge the gap between these gray box strategies and the real-world black box setting in the domain of industrial control systems. This approach involves training an adaptive machine learning model that approximates the information that is missing in a black box setting. We propose three different approaches for the model, combine them with an evolutionary testing approach, and perform an evaluation using a System under Test with known vulnerabilities. Our evaluation shows that the model is indeed able to learn valuable information about a previously unknown system, and that more vulnerabilities can be uncovered with our approach. The model-based approach using a Decision Tree was able to find a significantly higher number of vulnerabilities than the two baseline fuzzers.

show abstract

Section: Related Workmentioning

confidence: 99%

Smarter Evolution: Enhancing Evolutionary Black Box Fuzzing with Adaptive Models

Borcherding,

Morawetz,

Pfrang

2023

Sensors

View full text Add to dashboard Cite

show abstract

“…Automated learning of a protocol state graph has been done for graybox settings (e.g. [16]), and for blackbox settings (e.g. [6], [7]).…”

Section: Future Workmentioning

confidence: 99%

The Bandit’s States: Modeling State Selection for Stateful Network Fuzzing as Multi-armed Bandit Problem

Borcherding,

Giraud,

Fitzgerald

et al. 2023

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)

View full text Add to dashboard Cite

Network interfaces of Industrial Control Systems are a common entry point for attackers, and thus need to be thoroughly tested for vulnerabilities. One way to perform such tests is with network fuzzers, which randomly mutate network packets to induce unexpected behavior and vulnerabilities. Highly stateful network protocols pose a particular challenge to fuzzers, since a fuzzer needs to be aware of the states in order to find deep vulnerabilities. Even if a fuzzer is aware of the states of a stateful network protocol, there are still several challenges to overcome. The challenge we focus on is deciding which state to test next. To make this decision, the fuzzer needs to strike a balance between exploiting known states and exploring states not yet tested. We propose to model this exploration versus exploitation dilemma using a Multi-armed Bandit. In this work, we present two modeling approaches and preliminary experiments. We choose to model the state selection problem with (I) a stochastic Multi-armed Bandit, and (II) an adversarial Multi-armed Bandit. The latter takes into account that coverage can only be discovered once, and that the underlying reward probability therefore decreases over time. Although the adversarial Multi-armed Bandit models the state selection problem more accurately, our experiments show that both approaches lead to statistically indistinguishable fuzzer performance. Furthermore, we show that the baseline fuzzer AFLNet leads to significantly better results in terms of coverage. Building on these unintuitive preliminary results, we aim to investigate the behavior of the agents in more detail, to include additional modeling approaches, and to use additional Systems under Test for the evaluation.

show abstract