Files

NordSEC_NACT_camera_ready.pdf
  • Open Access
  • Adobe PDF
  • 670.88 KB
Download

Details

Authors
Abstract
The rapid evolution of cyber threats has increased the need for robust methods to discover vulnerabilities in increasingly complex and diverse network protocols. This paper introduces Network Attack-centric Compositional Testing (NACT ) [12], a novel methodology designed to discover new vulnerabilities in network protocols and create scenarios to reproduce these vulnerabilities through attacker models. NACT in- tegrates composable attacker specifications, formal specification muta- tions, and randomized constraint-solving techniques to generate sophis- ticated attack scenarios and test cases. The methodology enables compre- hensive testing of both single-protocol and multi-protocol interactions. Through case studies involving a custom minimalist protocol (MiniP) and five widely used QUIC implementations, NACT is shown to effec- tively identify, reproduce, and find new real-world vulnerabilities such as version negotiation abuse. Additionally, by comparing the current and older versions of these QUIC implementations, NACT demonstrates its ability to detect both persistent vulnerabilities and regressions. Finally, by supporting cross-protocol testing within a black-box testing frame- work, NACT provides a versatile approach to improve the security of network protocols
Affiliations

Citations

  • APA
  • Chicago
  • FWB

Crochet, C., Aoga, J., Legay, A., & et al. (2024). Formally Discovering and Reproducing Network Protocols Vulnerabilities. https://hdl.handle.net/2078.5/233465