# Automated Attack Synthesis by Extracting Finite State Machines from Protocol Specification Documents

arXiv: https://arxiv.org/abs/2202.09470 · HTML: https://mlsanity.com/paper/2202.09470/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- Builds on 17 of its 72 references that are in the map.
- First posted on arXiv 18 Feb 2022.

## Builds on (most cited first, 17 of 17)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [PyTorch: An Imperative Style, High-Performance Deep Learning Library](https://mlsanity.com/paper/1912.01703/) (2019)
- [Distributed Representations of Words and Phrases and their Compositionality](https://mlsanity.com/paper/1310.4546/) (2013)
- [Deep contextualized word representations](https://mlsanity.com/paper/1802.05365/) (2018)
- [Don't Stop Pretraining: Adapt Language Models to Domains and Tasks](https://mlsanity.com/paper/2004.10964/) (2020)
- [Neural Architectures for Named Entity Recognition](https://mlsanity.com/paper/1603.01360/) (2016)
- [AllenNLP: A Deep Semantic Natural Language Processing Platform](https://mlsanity.com/paper/1803.07640/) (2018)
- [End-to-end Sequence Labeling via Bi-directional LSTM-CNNs-CRF](https://mlsanity.com/paper/1603.01354/) (2016)
- [Entity, Relation, and Event Extraction with Contextualized Span Representations](https://mlsanity.com/paper/1909.03546/) (2019)
- [Named Entity Recognition with Bidirectional LSTM-CNNs](https://mlsanity.com/paper/1511.08308/) (2015)
- [Learning Structured Natural Language Representations for Semantic Parsing](https://mlsanity.com/paper/1704.08387/) (2017)
- [Semi-Automated Protocol Disambiguation and Code Generation](https://mlsanity.com/paper/2010.04801/) (2020)
- [Leveraging Textual Specifications for Grammar-based Fuzzing of Network Protocols](https://mlsanity.com/paper/1810.04755/) (2018)
- [Synthesizing Finite-state Protocols from Scenarios and Requirements](https://mlsanity.com/paper/1402.7150/) (2014)
- [Automated Attacker Synthesis for Distributed Protocols](https://mlsanity.com/paper/2004.01220/) (2020)
- [Counterexample Classification](https://mlsanity.com/paper/2108.00885/) (2021)

## Built on by (most cited first, 8 of 8)

- [Hermes: Unlocking Security Analysis of Cellular Network Protocols by Synthesizing Finite State Machines from Natural Language Specifications](https://mlsanity.com/paper/2310.04381/) (2023)
- [CellularLint: A Systematic Approach to Identify Inconsistent Behavior in Cellular Network Specifications](https://mlsanity.com/paper/2407.13742/) (2024)
- [Synthesizing Precise Protocol Specs from Natural Language for Effective Test Generation](https://mlsanity.com/paper/2511.17977/) (2025)
- [An Agentic Flow for Finite State Machine Extraction using Prompt Chaining](https://mlsanity.com/paper/2507.11222/) (2025)
- [Automated Network Protocol Testing with LLM Agents](https://mlsanity.com/paper/2510.13248/) (2025)
- [Automated Synthesis of Cloud Emulators](https://mlsanity.com/paper/2608.23842/) (2026)
- [RFCLLM: Evaluating LLMs' Reasoning Ability of Network Protocol State Machines](https://mlsanity.com/paper/2609.13389/) (2026)
- [LASER: Defeasible Certificate Search for Long-Range Protocol Dependencies](https://mlsanity.com/paper/2610.14552/) (2026)

## Abstract (arXiv)

Automated attack discovery techniques, such as attacker synthesis or model-based fuzzing, provide powerful ways to ensure network protocols operate correctly and securely. Such techniques, in general, require a formal representation of the protocol, often in the form of a finite state machine (FSM). Unfortunately, many protocols are only described in English prose, and implementing even a simple network protocol as an FSM is time-consuming and prone to subtle logical errors. Automatically extracting protocol FSMs from documentation can significantly contribute to increased use of these techniques and result in more robust and secure protocol implementations. In this work we focus on attacker synthesis as a representative technique for protocol security, and on RFCs as a representative format for protocol prose description. Unlike other works that rely on rule-based approaches or use off-the-shelf NLP tools directly, we suggest a data-driven approach for extracting FSMs from RFC documents. Specifically, we use a hybrid approach consisting of three key steps: (1) large-scale word-representation learning for technical language, (2) focused zero-shot learning for mapping protocol text to a protocol-independent information language, and (3) rule-based mapping from protocol-independent information to a specific protocol FSM. We show the generalizability of our FSM extraction by using the RFCs for six different protocols: BGPv4, DCCP, LTP, PPTP, SCTP and TCP. We demonstrate how automated extraction of an FSM from an RFC can be applied to the synthesis of attacks, with TCP and DCCP as case-studies. Our approach shows that it is possible to automate attacker synthesis against protocols by using textual specifications such as RFCs.