Reverse-engineering of communication protocols

摘要

The authors study the problem of locating the differences between a protocol specification and its implementation. They give an exact procedure for solving this problem. If there is only one difference between the implementation and the specification, then the algorithm will locate the difference and therefore identify the implementation machine. Otherwise, it will detect that the implementation machine has more than one change. The run time of the algorithm is a low-degree polynomial in the number of states and inputs of the machine. Both a brute-force version of the algorithm with a cost O(pn/sup 5/), where n is the number of states of the specification machine and p is the number of inputs, and a fast algorithm with a cost O(pn/sup 3/ log n) are described. An improvement for which the cost on the average is O(pn/sup 2/ log n) is also given. A heuristic procedure that uses a test of comparable length to a conformance test sequence which has been used successfully in practice is described.