Learning Fragments of the TCP Network Protocol

Combining Model Learning and Model Checking to Analyze TCP Implementations

“…However, these applications only consider specifications of a single system component, and do not analyze networks of learned models. Our results considerably extend previous work on learning fragments of TCP by [17] since we have (1) added inputs corresponding to calls from the upper layer, (2) added transmission of data, (3) inferred models of TCP clients in addition to servers, and (4) learned models for FreeBSD in addition to Windows and Linux. In order to obtain tractable models we use the theory of abstractions from [2], which in turn is inspired by earlier work on predicate abstraction [15,28].…”

“…Model learning, or active automata learning [40,6,1], is emerging as a highly effective technique to obtain models of protocol implementations. In fact, all the standard violations reported in [17,37,13,42] have been discovered (or reconfirmed) with the help of model learning. The goal of model learning is to obtain a state model of a system by providing inputs to and observing outputs from a black-box system.…”

“…Bugs specific to an implementation can never be captured using this way of model checking. For instance, [17] shows that both the Windows 8 and Ubuntu 13.10 implementations of TCP violate the standard. In [37], new security flaws were found in three of the TLS implementations that were analyzed, all due to violations of the standard.…”

Refactoring of Legacy Software Using Model Learning and Equivalence Checking: An Industrial Experience Report

“…In this approach, a learning algorithm interacts with a software component by sending inputs and observing the resulting output, and uses this information to construct a state machine model. Active learning has, for instance, been successfully applied to learn models of (and to find mistakes in) implementations of protocols such as TCP [12] and TLS [8], to establish correctness of protocol implementations relative to a given reference implementation [2], and to generate models of a telephone switch [18] and a printer controller [21]. Learning-based testing [11] combines active learning and model checking.…”

Enhancing Automata Learning by Log-Based Metrics

“…Active learning has been successfully applied to learn models of (and find mistakes in) implementations of major protocols such as TCP [13] and TLS [9]. We have also used the approach to learn models of embedded control software at Océ [21] and to support refactoring of software at Philips HealthTech [19].…”