A Formal Approach to Robustness Testing of Network Protocol

Abstract

Abstract. Robustness testing of network protocol aims to detect vulnerabilities of protocol specifications and implementations under critical conditions. However, related theory is not well developed and prevalent test practices have deficiencies. This paper builds a novel NPEFSM model containing sufficient inputs and their processing rules to formalize complex protocol. Based on this model, Normal-Verification Sequence is proposed to enhance verdict mechanism. We adopt various strategies to generate anomalous values for some fields of messages and further apply pairwise combination to systematically mutate messages. We propose compound anomalous test case to simplify test sequences and give its generation algorithm. Standard test specification language TTCN-3 is extended to describe compound anomalous test cases. As a case study, we test OSPFv2 sufficiently with a test system based on extended TTCN-3. Our method and test system can effectively discover vulnerabilities of protocol implementations as well as their inconsistencies with specifications.

A formal approach to robustness testing of network protocol with time constraints

“…Our previous work [5] proposes a model called NPEFSM. In order to model time‐constrained network protocol, this paper proposes Timed NPEFSM.…”

“…As most invalid messages and their processing rules are not well specified, state transitions after these invalid injections are often nondeterministic. So we build a model for protocol robustness testing using NPEFSM (Nondeterministic Parameterized Extended Finite State Machine) in our previous work [5]. Our model covers more detailed and precise nondeterministic features than traditional nondeterministic FSM and EFSM model.…”

“…This model contains two timers: HelloInterval and RouterDeadInterval. In our previous work [5], we give some examples about the nondeterministic transitions of OSPFv2. Some time constraints may also trigger nondeterministic transitions.…”

“…The situation that only one field is contained in $\def\reals{{\rm I\!F}}_l$ , i.e., ∣$\def\reals{{\rm I\!F}}_l$ ∣ = 1, is called Single‐field Mutation ; we define single‐field mutation rules as Fun $_{{\rm FieldMutation}}$ ( F i ), which means the set of all anomalous field values mutated from the field F i . The situation that multiple fields are contained in $\def\reals{{\rm I\!F}}_l$ , i.e., ∣$\def\reals{{\rm I\!F}}_l| \geq 2$ , is called Multi‐field Mutation ; we use pairwise algorithm to generate anomalous values for multi‐field mutation [5] and define the function pairwise ($\def\reals{{\rm I\!F}}_l$ , Q ) to represent the set of all anomalous values mutated from the fields set $\def\reals{{\rm I\!F}}_l$ , where, Q = {$q_{F_1},q_{F_2},...,q_{F_n}$ }, here each $q_{F_i}$ is a set of values for field F i ( i = 1,2,…, n ). The results of function pairwise is $V_{\def\reals{{\rm I\!F}}_l}$ = { V $_{{\rm 1}}$ , V $_{{\rm 2}}$ , …V i , … }, where each V i = {$v_{F_1},v_{F_2},...,v_{F_n}$ }, $v_{F_j}$ ∈$q_{F_j}$ ( j = 1,2,…, n ), i.e., V i is a n ‐dimension vector containing values for field F $_{{\rm 1}}$ , F $_{{\rm 2}}$ ,…, F n , respectively.…”

“…As the scale and complexity of Internet increases, Internet carries more noise, disturbance, misconfiguration, and vicious man‐made attacks [1]. The critical requirements on reliability, fault‐tolerance, and security of network devices highlight protocol robustness testing which is the test to verify whether IUT (Implementation under Test) can function correctly in the presence of invalid inputs or stressful environmental conditions [2–5]. Network protocols often have time constrains.…”