Improving Protocol State Fuzzing of SSH

With the scale and use of the Internet nowadays, it is crucial that we can effectively test the correctness and security of systems that handle our personal data. In this thesis, we improve upon a previous work by Verleg. Verleg used protocol state fuzzing to test several implementations of the SSH protocol. By adapting a more formal methodology, we achieve higher confidence in our results. We improve upon Verleg’s methodology in three ways: First, we expand the scope of our learned model, by learning a single model for the three layers of SSH. Then, we achieve a degree of confidence in our model by using a more advanced testing algorithm. Finally, we increase confidence in the analysis of model by performing formal model checking instead of manual inspection of results.