Problem
Research questions and friction points this paper is trying to address.
layer order
cybersecurity
automata
request desynchronization
evidence transformation
Layer Order Semantics for Automata-Based Cybersecurity
🤖 AI Summary
This work addresses the visibility of security-relevant facts in layered network security pipelines, where discrepancies in processing order—such as those exploited by order-sensitive attacks like HTTP request smuggling—can undermine correctness. For the first time, layer ordering is formally integrated into a semantic security framework through a composable automaton model. This model endows transformation sequences with finite-state semantics via layer-order automata, deterministic order-preserving transducers, evidence-tagging mechanisms, and decision automata, and precisely characterizes the regular prefix-closed conditions necessary for faithful online execution. The approach enables formal identification of boundary-inconsistency scenarios including CL.TE, TE.CL, TE.TE, and HTTP/2 downgrade attacks, establishes a component-permutation classification based on equivalent decision languages, and proves the equivalence of the proposed framework to finite-output deterministic edit transducers.
📝 Abstract
Layered cybersecurity pipelines transform evidence before they decide on it, and the order of those transformations determines which security facts become visible to which layer. This paper gives layer order a finite-state semantics built from a layer-order automaton, deterministic sequential security transducers, evidence markers, and a final decision automaton. The worked case is HTTP request desynchronization: front-end and back-end processors compute incompatible request boundaries, and the same trace is detected or missed according to whether framing evidence reaches the parser-differential layer before it commits. The results separate completed-trace recognition, online editing, decision synthesis, and faithful enforcement; characterize faithful online enforcement as the regular prefix-closed case under causal visibility; and show that regular policies beyond that boundary remain recognizable without becoming deployable enforcers. The framework is monolithically equivalent to finite-output deterministic edit automata, while preserving layer-local invariants such as marker birth, marker survival, and reorder-sensitive visibility. A concrete parser-pair semantics identifies the forbidden marker factor with CL.TE, TE.CL, TE.TE, and HTTP/2-downgrade boundary disagreement under the stated abstraction, and a contextual reorder congruence classifies which component permutations induce the same decision language. The result is an automata-theoretic account of order-sensitive security failures and a compositional vocabulary for auditing, synthesizing, and comparing layered enforcement pipelines.
Innovation
Methods, ideas, or system contributions that make the work stand out.
layer-order automaton
security transducer
evidence marker
order-sensitive enforcement
parser-differential semantics
🔎 Similar Papers
No similar papers found.
