Patent ID: 8316447

Claim:
A method for analyzing vulnerability of a network device under analysis (DUA) to protocol abuse of a higher-layer network protocol from a layered network protocol, the layered network protocol including lower-layer network protocols that work with the higher-layer network protocol, the method comprising: discovering using black box testing a plurality of valid lower-layer message-delivery preconditions for the DUA to receive a message in the higher-layer network protocol, where the plurality of valid lower layer message-delivery preconditions are not known a priori, the discovering comprising repeatedly: selecting a lower-layer network protocol from the layered network protocol, selecting a configuration of the lower-layer network protocol from a plurality of configurations associated with the lower-layer network protocol, and sending a first message toward the DUA using the selected lower-layer network protocol and the selected configuration; based on a response or non-response to the first message, determining whether the selected configuration of the selected lower-layer network protocol comprises a valid lower-layer message-delivery precondition by determining whether the selected lower-layer network protocol as implemented in the DUA (1) supports the selected configuration, and (2) is used by the DUA to receive messages in the higher-layer network protocol; and for at least two of the discovered plurality of valid lower-layer message-delivery preconditions, attacking the DUA multiple times, the attacking comprising: establishing a lower-layer connection with the DUA using the lower-layer network protocol according to the one of the discovered valid lower-layer message-delivery preconditions, on top of the lower-layer connection, establishing a higher-layer connection with the DUA using the higher-layer network protocol, and through the higher-layer connection, sending to the DUA test messages that are invalid mutations of valid messages with respect to the higher-layer network protocol.