Patent ID: 7958560

Claim:
A security analyzer device for attacking a network device under analysis (DUA) and generating an executable program for recreating on another computing device an attack that triggered a vulnerability of the DUA to protocol abuse of a network communication protocol, comprising: a computer processor for executing computer program instructions; and a computer-readable storage medium having executable computer program instructions for a single software application tangibly embodied thereon, the executable computer program instructions for the computer processor to perform the steps of: generating a plurality of malformed test messages of the network communication protocol, comprising: generating a rooted graph expressing a message syntax of the network communication protocol, the message syntax specifying a plurality of semantic elements in messages of the network communication protocol, the rooted graph referencing a plurality of rules specifying how to generate a semantic element for a message of the communication protocol, traversing the rooted graph and applying the referenced rules, to generate an output graph, and traversing the output graph to generate the plurality of malformed test messages, the test messages malformed with respect to the network communication protocol; generating multiple attacks on the DUA, the attacks comprising sending the malformed test messages to the DUA; receiving response messages from the DUA in response to the malformed test messages; analyzing the malformed test messages and response messages to identify an attack that triggers the vulnerability in the DUA; and generating the executable program that, when executed by the other computing device, will recreate the identified attack that triggers the vulnerability in the DUA.