# Automated Attack Synthesis by Extracting Finite State Machines from Protocol Specification Documents

> Extracts protocol FSMs from RFC prose using technical word representations, zero-shot text mapping, and rules, then uses the extracted FSMs to synthesize attacks.

- Authors: Maria Leonor Pacheco; Max von Hippel; Ben Weintraub; Dan Goldwasser; Cristina Nita-Rotaru
- Venue: IEEE Symposium on Security and Privacy 2022
- Status: Conference accepted
- Publication / posting date: February 18, 2022
- Date source: First arXiv submission date; the arXiv comment names the venue.
- First arXiv submission: February 18, 2022
- arXiv: 2202.09470
- Reviewed arXiv version: v1
- Sources reviewed: 2026-11-06
- Added to the catalog: 2026-11-06
- Original paper: <https://arxiv.org/abs/2202.09470>
- PDF: <https://arxiv.org/pdf/2202.09470>
- BibTeX: <https://awesomerea.org/papers/citations/paper-attack-synthesis-fsm.bib>
- Catalog page: <https://awesomerea.org/papers/paper-attack-synthesis-fsm/>
- Record JSON: <https://awesomerea.org/papers/paper-attack-synthesis-fsm/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/papers/paper-attack-synthesis-fsm/index.md)

## Scope and limitations

Evaluates FSM extraction on RFCs for six protocols: BGPv4, DCCP, LTP, PPTP, SCTP, and TCP. Attack synthesis case studies cover TCP and DCCP.

## Why it fits this collection

Reconstructs protocol state machines from prose specifications for security analysis.

## Publication and review notes

The arXiv comment reads: To appear in IEEE Security and Privacy, 2022

## Primary sources

1. <https://arxiv.org/abs/2202.09470>

## About this entry

Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.