Abstract:

Protocol state machine active inference is a technique that relies on active automata learning.However, the abstraction of the alphabet and the construction of the mapper present critical challenges.Due to the diversity of messages of the same type, the response types of the same type are different, causing the method of regarding the message types as the alphabet will result in the loss of states or state transitions.To address the issue, message types were refined into subtypes according to the different responses and a progressive active inference method was proposed.The proposed method extracted the state fields from the existing protocol data to construct the initial alphabet and the mapper, and obtained the initial state machine based on active automata learning.It then mutated the existing messages to explore the response sequences, which were inconsistent with the current state machine.The mutated message was regarded as a protocol subtype and added to the alphabet, and a new state machine was inferred progressively based on the new alphabet.In order to reduce the interactions, a pre-response query algorithm was proposed based on prefix matching for the caching mechanism in the active automata learning.The ProLearner tool was utilized to evaluate the proposed method in the context of the SMTP and RSTP protocols.It is verified that the pre-response query method can effectively reduce the number of actual interactions, with an average reduction rate of about 10%.

Key words: protocol reverse analysis, active automata learning, protocol state machine inference, Mealy automata, mapper