Back to results
US 10,454,968 B1Granted
Regular expression based cyber fuzzing attack preventer
AssigneeRockwell Collins, Inc.
InventorsMark A. Bortz, David S. Hardin, James N. Potts, Konrad L. Slind
Life of this patent
Estimating the term…
Abstract
Testing a system against fuzzing attacks includes negating all regular expressions used in the corresponding language, and applying those negated regular expressions to a system interface. Only expressions definitively outside the scope of protocol specification implicate vulnerabilities to fuzzing attacks. The system detects fuzzing attacks by continuously monitoring packets of data and only passing through packets that conform to regular expressions of the language.
Claims17
A method for identifying a fuzzing attack in a system interface comprising:
- accessing a set of compiled regular expressions indicative of a protocol specification for a system interface;
- translating and transforming the protocol specification into a higher order logic form suitable for satisfiability modulo theory (SMT) procedure for recursive functions over tree-structured data;
- producing a formal mathematical description of each source regular expression;
- compiling each source regular expression such that each compiled regular expression corresponds to a source regular expression;
- identifying a verification artifact associated with each compiled regular expression;
- verifying each compiled regular expression via comparison of the identified verification artifacts to a corresponding formal mathematical description of a corresponding source regular expression;
- producing a formal mathematical description of each regular expression;
- supplying the formal mathematical description and translated protocol specification to a theorem proving tool;
- verifying a compiler with the theorem proving tool;
- receiving a data stream comprising a plurality of data packets;
- comparing each of the plurality of data packets to the set of compiled regular expressions;
- determining whether at least one data packet mismatches the protocol specification for the system interface of the set of compiled regular expressions;
- and
- generating an alert indicative of the data packet mismatching the protocol specification for the system interface.
11 more elements
A computer apparatus comprising:
- at least one processor in data communication with a memory storing processor executable code for electronically configuring the at least one processor to:
- access a plurality of compiled regular expressions corresponding to a plurality of sou rce regular expressions;
- produce a formal mathematical description of each source regular expression by translating and transforming each source regular expression to higher order logic suitable satisfiability modulo theory (SMT) decision procedure for recursive functions over tree-structured data;
- compile each source regular expression such that each compiled regular expression corresponds to a source regular expression;
- identify a verification artifact associated with each compiled regular expression;
- verify each compiled regular expression via comparison of the identified verification artifacts to a corresponding formal mathematical description of a corresponding source regular expression;
- receive a data stream comprising data packets;
- compare a data packet from the data stream to one or more of the compiled regular expressions;
- and
- determine whether at least one data packet mismatches the protocol specification for the system interface of the set of compiled regular expressions;
- and
- generate an alert indicative of the data packet mismatching the protocol specification for the system interface.
9 more elements
A apparatus comprising:
- a system interface;
- a compiler configured to generate a plurality of compiled regular expressions representative of a plurality of negated source regular expressions, translate and transform the protocol specification into higher order logic a form suitable for satisfiability modulo theory procedure for recursive functions over tree-structured data;
- a verifier connected to the compiler, the verifier configured to compare each of the compiled regular expressions to a formal mathematical description and the translated protocol specification;
- a memory connected to the compiler configured to store each of the plurality of compiled regular expressions;
- and
- a fuzzing engine connected to the memory and configured to identify compiled negated regular expressions that do not conform to a protocol specification, apply each of the identified compiled negated regular expressions to the system interface, and generate a set of fuzzing data packets;
- wherein the engine determines whether at least one data packet mismatches the protocol specification for the system interface of the set of compiled regular expressions;
- and
- generates alerts indicative of the data packet mismatching the protocol specification for the system interface.
6 more elements
Dependencies are inferred from the claim text.