Granted Patent B1

US 7,185,232 · App. 10/087,000 · Granted Feb 27, 2007

Abstract

Claims (64)

1. A method of creating a fault-inducing transaction representation in a network, the method comprising:

interjecting a pattern with fault-inducing sub-fields, where the pattern is an expression including a literal string and a wildcard character class, wherein interjecting the pattern comprises at least one of the following: providing alternative character encoding for a character in the expression, providing a double delimiter in the expression, providing all delimiters in the expression, providing no values in the expression, providing a single character and delimiter-value pair in the expression, providing an unbalanced pair in the expression, replacing a delimiter with random ranges that cover the value of the delimiter, providing an alternative encoding to encode a transaction field with a character that is equal in nature and different in representation, providing a prefixed escape in the expression, providing ghost character encoding in the expression, controlling a user identity which is a field indicating resource name or user identity, injecting unfiltered metacharacters to a secondary process, providing extraneous meta-characters for causing misclassification, or parsing out a delimiter to obtain an intermediate representation of the expression, where a value in the expression is replaced by a buffer function; and

using the expression to form a subsequent expression that can be used by a target system to detect and trigger on the network at least one transaction that matches the expression.

2. An article of manufacture, comprising:

a computer-readable medium having stored thereon instructions to:

interject a pattern with fault-inducing sub-fields, where the pattern is an expression including a literal string and a wildcard character class, wherein interjecting the pattern comprises at least one of the following:

providing alternative character encoding for a character in the expression, providing a double delimiter in the expression, providing all delimiters in the expression, providing no values in the expression, providing a single character and delimiter-value pair in the expression, providing an unbalanced pair in the expression, replacing a delimiter with random ranges that cover the value of the delimiter, providing an alternative encoding to encode a transaction field with a character that is equal in nature and different in representation, providing a prefixed escape in the expression, providing ghost character encoding in the expression, controlling a user identity which is a field indicating resource name or user identity, injecting unfiltered metacharacters to a secondary process, providing extraneous meta-characters for causing misclassification, or parsing out a delimiter to obtain an intermediate representation of the expression, where a value in the expression is replaced by a buffer function; and

use the expression to form a subsequent expression that can be used by a target system to detect and trigger on the network at least one transaction that matches the expression.

3. An apparatus for creating a fault-inducing transaction representation in a network, the apparatus comprising:

means for interjecting a pattern with fault-inducing sub-fields, where the pattern is an expression including a literal string and a wildcard character class, wherein interjecting the pattern comprises at least one of the following: providing alternative character encoding for a character in the expression, providing a double delimiter in the expression, providing all delimiters in the expression, providing no values in the expression, providing a single character and delimiter-value pair in the expression, providing an unbalanced pair in the expression, replacing a delimiter with random ranges that cover the value of the delimiter, providing an alternative encoding to encode a transaction field with a character that is equal in nature and different in representation, providing a prefixed escape in the expression, providing ghost character encoding in the expression, controlling a user identity which is a field indicating resource name or user identity, injecting unfiltered metacharacters to a secondary process, providing extraneous meta-characters for causing misclassification, or parsing out a delimiter to obtain an intermediate representation of the expression, where a value in the expression is replaced by a buffer function; and

coupled to the interjecting means, means for using the expression to form a subsequent expression that can be used by a target system to detect and trigger on the network at least one transaction that matches the expression.

4. A method of testing a target in a network by fault injection, the method comprising:

defining a transaction baseline;

modifying at least one of an order and a structure of the transaction baseline to obtain a modified transaction with malformed grammar, wherein the modifying step comprises at least one of the following: providing alternative character encoding for a character in the transaction baseline, creating a double delimiter in the transaction baseline, providing all delimiters in the transaction baseline, providing no values in the transaction baseline, providing a single character and delimiter-value pair at a repeated large buffer in the transaction baseline, providing an unbalanced pair in the transaction baseline, replacing a delimiter with random ranges that cover the value of the delimiter, providing an alternative encoding to encode a transaction field with a character that is equal in nature and different in representation, providing a prefixed escape in the transaction baseline, providing ghost character encoding in the transaction baseline, controlling the user identity which is a field indicating resource name or user identity, injecting unfiltered metacharacters to a secondary process, providing extraneous meta-characters for causing misclassification, or parsing out a delimiter to obtain an intermediate representation of the transaction baseline, where a value in the transaction baseline is replaced by a buffer function; and

transmitting the modified transaction to a target.

5. The method of claim 4 , further comprising:

after transmitting the modified transaction, receiving a feedback from the target to determine fault occurrence.

6. The method of claim 4 wherein the modifying step comprises:

removing a field from the transaction.

7. The method of claim 4 wherein the modifying step comprises:

duplicating a field in the transaction.

8. The method of claim 4 wherein the modifying step comprises:

using value injection to alter an input field in the transaction.

9. The method of claim 4 wherein the modifying step comprises:

determining a value injection based on numerical ranges of the input field content.

10. A method of testing a target on a network by fault injection, the method comprising:

defining a transaction baseline; and

modifying an input field in the transaction baseline to obtain a modified transaction with malformed value, wherein modifying the input field comprises at least one of the following: providing alternative character encoding for a character in the transaction baseline, creating a double delimiter in the transaction baseline, providing all delimiters in the transaction baseline, providing no values in the transaction baseline, providing a single character and delimiter-value pair at a repeated large buffer in the transaction baseline, providing an unbalanced pair in the transaction baseline, replacing a delimiter with random ranges that cover the value of the delimiter, providing an alternative encoding to encode a transaction field with a character that is equal in nature and different in representation, providing a prefixed escape in the transaction baseline, providing ghost character encoding in the transaction baseline, controlling the user identity which is a field indicating resource name or user identity, injecting unfiltered metacharacters to a secondary process, providing extraneous meta-characters for causing misclassification, or parsing out a delimiter to obtain an intermediate representation of the transaction baseline, where a value in the transaction baseline is replaced by a buffer function.

11. The method of claim 10 , further comprising:

after transmitting the modified transaction, receiving a feedback from a target to determine fault occurrence.

12. A method of testing a target in a network by fault injection, the method comprising:

defining a transaction baseline; and

modifying the transaction baseline to obtain a modified transaction, wherein the modified transaction comprises at least one of: an alternative character encoding for a character in the transaction baseline, a double delimiter in the transaction baseline, all delimiters in the transaction baseline, fields with no values in the transaction baseline, a single character and delimiter-value pair at a repeated large buffer in the transaction baseline, an unbalanced pair in the transaction baseline, random ranges that cover a value of a delimiter, an alternative encoding to encode a transaction field with a character that is equal in nature and different in representation, a prefixed escape in the transaction baseline, ghost character encoding in the transaction baseline, a user identity which is a field indicating resource name or user identity, unfiltered metacharacters injected to a secondary process, extraneous meta-characters for causing misclassification, or a delimiter that is parsed to obtain an intermediate representation of the transaction baseline, where a value in the transaction baseline is replaced by a buffer function.

13. An apparatus for testing a target in a network by fault injection, the apparatus comprising:

a driver configured to generate patterns, where a pattern can generate a plurality of packets for transmission to the target, the pattern being represented by an expression with a literal string and a wild character class, wherein the driver modifies the expression by performing at least one of the following: providing alternative character encoding for a character in the expression, providing a double delimiter in the expression, providing all delimiters in the expression, providing no values in the expression, providing a single character and delimiter-value pair in the expression, providing an unbalanced pair in the expression, replacing a delimiter with random ranges that cover the value of the delimiter, providing an alternative encoding to encode a transaction field with a character that is equal in nature and different in representation, providing a prefixed escape in the expression, providing ghost character encoding in the expression, controlling a user identity which is a field indicating resource name or user identity, injecting unfiltered metacharacters to a secondary process, providing extraneous meta-characters for causing misclassification, or parsing out a delimiter to obtain an intermediate representation of the expression, where a value in the expression is replaced by a buffer function; and

a network interface coupled to the driver and configured to transmit and receive network traffic.

14. An apparatus for testing a target on a network by fault injection, the apparatus comprising:

means for defining a transaction baseline; and

means for modifying an input field in the transaction baseline to obtain a modified transaction with malformed value, wherein modifying the input field comprises at least one of the following: providing alternative character encoding for a character in the transaction baseline, creating a double delimiter in the transaction baseline, providing all delimiters in the transaction baseline, providing no values in the transaction baseline, providing a single character and delimiter-value pair at a repeated large buffer in the transaction baseline, providing an unbalanced pair in the transaction baseline, replacing a delimiter with random ranges that cover the value of the delimiter, providing an alternative encoding to encode a transaction field with a character that is equal in nature and different in representation, providing a prefixed escape in the transaction baseline, providing ghost character encoding in the transaction baseline, controlling the user identity which is a field indicating resource name or user identity, injecting unfiltered metacharacters to a secondary process, providing extraneous meta-characters for causing misclassification, or parsing out a delimiter to obtain an intermediate representation of the transaction baseline, where a value in the transaction baseline is replaced by a buffer function.

15. The method of claim 10 , further comprising:

transmitting the modified transaction to a target.

16. The method of claim 10 , further comprising:

removing a field from the transaction baseline.

17. The method of claim 10 , further comprising:

duplicating a field in the transaction baseline.

18. The method of claim 10 , further comprising:

using value injection to alter an input field in the transaction baseline.

19. The method of claim 10 , further comprising:

determining a value injection based on numerical ranges of content in an input field.

20. The apparatus of claim 13 , wherein the driver modifies the expression by removing a field from the transaction baseline.

21. The apparatus of claim 13 , wherein the driver modifies the expression by duplicating a field in the transaction baseline.

22. The apparatus of claim 13 , wherein the driver modifies the expression by using value injection to alter an input field in the transaction baseline.

23. The apparatus of claim 13 , wherein the driver modifies the expression by determining a value injection based on numerical ranges of content in an input field.

24. A method of testing a target in a network by fault injection, the method comprising:

defining a transaction baseline; and

modifying the transaction baseline to obtain a modified transaction, wherein the modified transaction comprises a content that is selected from the group consisting of: an alternative character encoding for a character in the transaction baseline, a double delimiter in the transaction baseline, all delimiters in the transaction baseline, fields with no values in the transaction baseline, a single character and delimiter-value pair at a repeated large buffer in the transaction baseline, an unbalanced pair in the transaction baseline, random ranges that cover a value of a delimiter, an alternative encoding to encode a transaction field with a character that is equal in nature and different in representation, a prefixed escape in the transaction baseline, ghost character encoding in the transaction baseline, a user identity which is a field indicating resource name or user identity, unfiltered metacharacters injected to a secondary process, extraneous meta-characters for causing misclassification, or a delimiter that is parsed to obtain an intermediate representation of the transaction baseline, where a value in the transaction baseline is replaced by a buffer function.

25. The method of claim 24 , further comprising:

transmitting the modified transaction to a target.

26. The method of claim 24 , wherein the content further comprises a field with content from the transaction baseline.

27. The method of claim 24 , wherein the content further comprises a duplicated-content in the transaction baseline.

28. The method of claim 24 , further comprising:

using value injection to alter an input field in the transaction baseline.

29. The method of claim 24 , further comprising:

determining a value injection based on numerical ranges of content in an input field.

Assignments (12)