2022 · Conference paper

The Closer You Look, The More You Learn: A Grey-box Approach to Protocol State Machine Learning

Chris McMahon Stone; Sam L. Thomas; Mathy Vanhoef; James Henderson; Nicolas Bailluet; Tom Chothia

StateInspector learns protocol Mealy machines by combining active message queries with snapshots of runtime memory, without requiring the target’s source code. It identifies candidate state-defining heap locations and uses taint and concolic analysis to merge states, evaluated by the authors on TLS 1.2 and WPA/2 implementations.

Scope and limitations

Assumes a finite Mealy-machine abstraction, a known input alphabet that can reach the relevant states, and state-defining memory on the heap exercised by bootstrap queries. State merging depends on configured search-depth and symbolic look-ahead bounds. Missing inputs or state stored elsewhere can leave behavior unmodeled; malformed harness messages, response abstraction and timeouts can create misleading transitions. Learned models and bounded checks do not establish full implementation equivalence, recover unknown message formats or reconstruct an application’s source code.

Why it fits this collection

Provides a concrete method for reconstructing communication-state behavior from executable protocol implementations and testing deviations from expected flows, complementing message-format inference.

Publication and review details

Venue: ACM CCS 2022
Status: Conference paper
Publication / posting date: November 7, 2022
Date source: The ACM-deposited Crossref record gives November 7, 2022 for both online and print publication; this date is not inferred solely from the conference schedule.
DOI: 10.1145/3548606.3559365

Reviewed the author-hosted 19-page copy; ACM-deposited metadata lists proceedings pages 2265–2278, so these are not asserted to be identical PDF versions. Public code documents a dated Linux setup with Python 2, OpenJDK 14, Maven, per-protocol input/reset harnesses and target-specific ptrace hooks. The taint path requires Triton and IDA Pro/Wine; omitting it can prevent termination on counters. No project-wide license was found in the inspected repository; component licenses and proprietary-tool rights remain separate. Only public text and paper documents were retrieved; no upstream code was executed and no encrypted archive was downloaded or decrypted.

Sources reviewed 2026-10-17

Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.

Scope and limitations

Why it fits this collection

Publication and review details

Primary sources