Modification of Messages for Analyzing the Security of Communication Protocols and Channels

• US 20080282352A1
• Filed: 05/07/2007
• Published: 11/13/2008
• Est. Priority Date: 05/07/2007
• Status: Active Grant

• Current Assignee: Spirent Communications Incorporated
• Original Assignee: Mu Security, Inc.
• Inventors: Guruswamy, Kowsik, Beddoe, Marshall A.
• Granted Patent: US 8,601,585 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A system is used to analyze the implementation of a protocol by a device-under-analysis (DUA). The system includes a source endpoint, a destination endpoint (the DUA), and a message generator. The source endpoint generates an original message and attempts to send it to the DUA. The original message is intercepted by the message generator, which generates a replacement message. The replacement message is then sent to the DUA instead of the original message. The replacement message is deliberately improper so as to analyze the DUA'"'"'s implementation of the protocol. The message generator includes a structure recognition system and a mutation system. The structure recognition system determines the underlying structure and/or semantics of a message. After the structure recognition system has determined the structure, it creates a description of the structure (a structure description). The mutation system modifies the message based on the structure description to generate a replacement message.

Claims

1. A method for modifying a message, comprising:

determining a structure of the message;

creating a description of the structure; and

modifying the message based on the description.

2. The method of claim 1, wherein determining the structure of the message comprises determining one or more fields that are included in the message.

3. The method of claim 1, wherein determining the structure of the message comprises determining the structure of the message based on a heuristic.

4. The method of claim 2, wherein the heuristic comprises sequence alignment.

5. The method of claim 2, wherein the heuristic comprises one element of a group containing a delimiter and a protocol extension.

6. The method of claim 2, wherein the heuristic comprises one element of a group containing a sliding window and a Sequitur algorithm.

7. The method of claim 1, wherein the description comprises text that conforms to the eXtended Markup Language (XML) format.

8. The method of claim 1, wherein modifying the message based on the description comprises:

parsing the message based on the description;

identifying a field of the parsed message; and

injecting invalid data into the field.

9. The method of claim 1, wherein the message conforms to a protocol.

10. The method of claim 1, wherein the message comprises a network packet.

11. The method of claim 1, further comprising intercepting the message.

12. The method of claim 1, further comprising intercepting the message before it is received by a device-under-analysis (DUA).

13. The method of claim 1, further comprising transmitting the modified message.

14. The method of claim 1, further comprising transmitting the modified message to a device-under-analysis (DUA).

15. A computer program product for modifying a message, the computer program product comprising a computer-readable medium containing computer program code for performing a method, the method comprising:

determining a structure of the message;

creating a description of the structure; and

modifying the message based on the description.

16. A system for modifying a message, comprising:

a structure recognition system configured to determine a structure of the message and to create a description of the structure; and

a mutation system configured to modify the message based on the description.