@@ -19,8 +19,7 @@ We have adapted the setting off timing parameters to each implementation.
\label{fig:sshserver}
\end{figure*}
OpenSSH was learned using a full alphabet, whereas DropBear and BitVise were learned using a restricted alphabet (as defined in Subsection~\ref{subsec:alphabet}). The primary reason for using a restricted alphabet was to reduce learning times.
Most inputs excluded were inputs that either didn't change behavior (like \textsc{debug} or \textsc{unimpl}), or that proved costly time-wise,
OpenSSH was learned using a full alphabet, whereas DropBear and BitVise were learned using a restricted alphabet (as defined in Subsection~\ref{subsec:alphabet}). The primary reason for using a restricted alphabet was to speed up learning. Most inputs excluded were inputs that either didn't change behavior (like \textsc{debug} or \textsc{unimpl}), or that proved costly time-wise,
and were not critical to penetrating all layers. A concrete example is the user/password based authentication inputs (\textsc{ua\_pw\_ok} and
\textsc{ua\_pw\_nok}). It would take the system 2-3 seconds to respond to an invalid password, a typical countermeasure to slow down
brute force attacks. By contrast, public key authentication resulted in quick responses. The \textsc{disconnect} input presented similar
...
...
@@ -48,7 +47,7 @@ Table~\ref{tab:experiments} describes the exact versions of the systems analyzed
@@ -46,7 +46,7 @@ the pattern of a \emph{minimally adequate teacher (MAT)} as proposed by Angluin~
Here learning is viewed as a game in which a \emph{learner} has to infer an unknown automaton by asking queries to a teacher. The teacher knows the automaton, which in our setting is a Mealy machine $\M$,
also called the System Under Learning ({\dsut}).
Initially, the learner only knows the input alphabet $I$ and output alphabet $O$ of $\M$.
The task of the learner is to learn $\M$through two types of queries:
The task of the learner is to learn $\M$via two types of queries:
\begin{itemize}
\item
With a \emph{membership query}, the learner asks what the response is to an input sequence $\sigma\in I^{\ast}$.