{
  "added_at": "2026-10-17",
  "arxiv_id": null,
  "arxiv_version_reviewed": null,
  "authors": [
    "Chris McMahon Stone",
    "Sam L. Thomas",
    "Mathy Vanhoef",
    "James Henderson",
    "Nicolas Bailluet",
    "Tom Chothia"
  ],
  "bibtex_url": "https://awesomerea.org/papers/citations/paper-stateinspector.bib",
  "citation": {
    "container_title": "Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security",
    "pages": "2265-2278",
    "publisher": "ACM",
    "sources": [
      "https://api.crossref.org/works/10.1145/3548606.3559365"
    ]
  },
  "code_url": "https://github.com/ChrisMcMStone/state-inspector",
  "date_basis": "The ACM-deposited Crossref record gives November 7, 2022 for both online and print publication; this date is not inferred solely from the conference schedule.",
  "date_basis_zh": "ACM 提交的 Crossref 记录将在线及印刷出版日期均列为 2022 年 11 月 7 日；该日期并非仅根据会议日程推定。",
  "date_precision": "day",
  "description_en": "StateInspector learns protocol Mealy machines by combining active message queries with snapshots of runtime memory, without requiring the target’s source code. It identifies candidate state-defining heap locations and uses taint and concolic analysis to merge states, evaluated by the authors on TLS 1.2 and WPA/2 implementations.",
  "description_zh": "StateInspector 将主动消息查询与运行时内存快照结合起来，学习协议的 Mealy 状态机，无需目标实现的源代码。它识别可能决定状态的堆内存位置，并通过污点分析与混合执行合并状态；作者在 TLS 1.2 和 WPA/2 实现上进行了评估。",
  "doi": "10.1145/3548606.3559365",
  "entry_url": "https://awesomerea.org/papers/paper-stateinspector/",
  "entry_url_zh": "https://awesomerea.org/zh/papers/paper-stateinspector/",
  "evidence_urls": [
    "https://doi.org/10.1145/3548606.3559365",
    "https://api.crossref.org/works/10.1145/3548606.3559365",
    "https://tomchothia.gitlab.io/Papers/greyboxstatelearning_ccs2022.pdf",
    "https://github.com/ChrisMcMStone/state-inspector/blob/103494e6d30fd7741e74393d844212acb4daf683/README.md",
    "https://github.com/ChrisMcMStone/state-inspector/blob/103494e6d30fd7741e74393d844212acb4daf683/.gitmodules",
    "https://github.com/ChrisMcMStone/state-inspector/blob/103494e6d30fd7741e74393d844212acb4daf683/ptrace-statemem/LICENSE",
    "https://github.com/ChrisMcMStone/state-inspector/blob/103494e6d30fd7741e74393d844212acb4daf683/blackbox/statelearner/LICENSE"
  ],
  "first_arxiv_date": null,
  "id": "paper-stateinspector",
  "json_url": "https://awesomerea.org/papers/paper-stateinspector/record.json",
  "kind": "research",
  "markdown_url": "https://awesomerea.org/papers/paper-stateinspector/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/papers/paper-stateinspector/index.md",
  "metadata_notes": "Reviewed the author-hosted 19-page copy; ACM-deposited metadata lists proceedings pages 2265–2278. Public code documents a dated Linux setup with Python 2, OpenJDK 14, Maven, per-protocol input/reset harnesses and target-specific ptrace hooks. The taint path requires Triton and IDA Pro/Wine; omitting it can prevent termination on counters. No project-wide license was found in the inspected repository; component licenses and proprietary-tool rights remain separate.",
  "metadata_notes_zh": "核查的是作者托管的 19 页版本；ACM 提交的元数据将论文集页码列为 2265–2278。公开代码记录了较早的 Linux 环境，包括 Python 2、OpenJDK 14、Maven、针对各协议的输入与重置测试驱动程序，以及目标相关的 ptrace 钩子。污点分析路径需要 Triton 和 IDA Pro/Wine；省略该路径可能因计数器而无法终止。所检查仓库中未发现项目整体许可证；各组件许可与专有工具使用权需分别处理。",
  "pdf_url": "https://tomchothia.gitlab.io/Papers/greyboxstatelearning_ccs2022.pdf",
  "project_url": null,
  "publication_date": "2022-11-07",
  "publication_status": "conference-paper",
  "record_type": "paper",
  "runtime_tested": false,
  "scope_limitations_en": "Assumes a finite Mealy-machine abstraction, a known input alphabet that can reach the relevant states, and state-defining memory on the heap exercised by bootstrap queries. State merging depends on configured search-depth and symbolic look-ahead bounds. Missing inputs or state stored elsewhere can leave behavior unmodeled; malformed harness messages, response abstraction and timeouts can create misleading transitions. Learned models and bounded checks do not establish full implementation equivalence, recover unknown message formats or reconstruct an application’s source code.",
  "scope_limitations_zh": "假设协议可抽象为有限 Mealy 状态机、已知输入字母表能到达相关状态，且决定状态的内存位于堆上并可由初始化查询触及。状态合并依赖所配置的搜索深度与符号执行前瞻上限。缺失的输入或存储在其他位置的状态可能导致行为未被建模；测试驱动程序构造的错误消息、响应抽象方式和超时也可能产生误导性转移。学习出的模型与有界检查不能证明实现完全等价，也不恢复未知消息格式或重建应用源代码。",
  "targets": [
    "protocol"
  ],
  "title": "The Closer You Look, The More You Learn: A Grey-box Approach to Protocol State Machine Learning",
  "title_zh": "越仔细观察，学到的越多：用于协议状态机学习的灰盒方法",
  "url": "https://doi.org/10.1145/3548606.3559365",
  "venue": "ACM CCS 2022",
  "verification": "source-reviewed",
  "verified_at": "2026-10-17",
  "why_fits_en": "Provides a concrete method for reconstructing communication-state behavior from executable protocol implementations and testing deviations from expected flows, complementing message-format inference.",
  "why_fits_zh": "提供从可执行协议实现中重建通信状态行为、检查其与预期流程偏差的具体方法，可与消息格式推断互补。",
  "year": 2022
}