Patent ID: 8095983

Claim:
A method for analyzing a security vulnerability of a network device under analysis (DUA) to protocol abuse of a network communication protocol, comprising: establishing a baseline snapshot of the DUA's state when the DUA is operating normally, comprising: sending to the DUA a message that is valid with respect to the network communication protocol; observing the DUA's response to the valid message; and establishing the baseline snapshot, the baseline snapshot based at least in part on the observed response of the DUA to the valid message; attacking the DUA multiple times, the attacks comprising sending to the DUA test messages that are invalid with respect to the network communication protocol; periodically establishing snapshots of the DUA's state during the attacks, based at least in part on observing responses of the DUA to the attacks; determining, based on the baseline snapshot and the snapshots established during the attacks, whether the DUA includes a security vulnerability; and responsive to a determination that the DUA includes a security vulnerability, using the baseline snapshot and the snapshots established during the attacks to identify which attack causes the security vulnerability.