ASPIRE: Automated Systematic Protocol Implementation Robustness Evaluation

1

• ASPIRE Automated Systematic Protocol
  Implementation Robustness Evaluation

2
CONTENT

• Introduction
• Definitions Taxonomy of Application Layer
  Protocols
• Fault Generation Algorithms
• Experiments Conclusions

3
Introduction

• Robustness Ability of an implementation to
  handle exceptional input in the form of faulty
  PDUs and continue normal protocol operation
• Protocol implementations differ in their behavior
  on faulty inputs
• Challenge in automated robustness protocol
  testing is systematic generation of faulty
  inputs
• Taxonomy of Application layer protocols used to
  design test cases for testing robustness

4
Defnitions

• PDU ltc1,cngt ci control fields
• Protocol Specification Defines syntax, semantics
  and allowed sequences of PDUs
• Protocol Implementation PSiSiltp1,h1,a1gt.ltpn
  ,hn,angt Pset of sequences, each tripleltpi,
  hi, aigt represents an action ai (send or receive)
  on PDU pi by host hi

5
Taxonomy of Application Layer Protocols

• Stateless Protocols - HTTP State information
  about a client (record of transaction) is not
  maintained susceptible to syntactical faulty
  PDUs
• Stateful Protocols SMTP State information
  about a client until the transaction is over is
  maintained susceptible to semantic faulty PDUs

6
Fault Generation Algorithms

• Generating syntactically faulty PDUs Maximally
  faulty PDUs grow exponentially in the number of
  fields Pruning Strategy (pair wise testing
  constraint)
• Generating semantically faulty PDUs Semantic
  faulty PDUs grow polynomially (manageable) Test
  case consists of a state, list of semantically
  faulty PDUs related to that state and sequence of
  correct PDUs which will drive the protocol to
  that state

7
Experiments Conclusions

• Evaluated Hypotheses
• - Protocol implementations differ in their
  behavior in terms of robustness to faulty PDU
  input for both stateful stateless protocols
• - Pair wise constraint in the pruning
  strategy does not reduce the capacity to evaluate
  robustness of different implementations

8

• Metrics
• -Reduced ratio syntactic faulty PDUs by
  the generation algorithm / combinatorial
  enumeration
• - Robustness ratio number of faulty inputs
  that were handled by implementation by continuing
  normal operation / total number of faulty inputs
• Results show the following to prove the
  hypotheses
• Average robustness ratio is not different for
  syntactic faulty PDUset of all posssible faulty
  PDUs
• Average robustness ratio of different
  implementations is different for semantic
  syntactic faults

9

• Thank You