网络协议的自动化模糊测试漏洞挖掘方法  

An Automatic Network Protocol Fuzz Testing and Vulnerability Discovering Method

作　　者：李伟明[1] 张爱芳[1] 刘建财[1] 李之棠[1] 

机构地区：[1]华中科技大学计算机学院,武汉430074

出　　处：《计算机学报》2011年第2期242-255,共14页Chinese Journal of Computers

基　　金：国家自然科学基金(60573120)资助

摘　　要：随着网络应用越来越复杂和重要,对网络协议的安全性要求也越来越高.模糊测试(Fuzz Testing)作为一种重要的测试手段,通过大量数据的注入来测试网络协议的安全,能够发现拒绝服务、缓冲区溢出和格式化字符串等多种重要漏洞.但是手工进行Fuzz Testing需要精确了解网络协议细节并需要繁重的工作来构造大量测试数据集,导致覆盖率有限,效果也不好.为了解决这个问题,文中结合网络协议逆向工程和Fuzz Testing技术,提出了一种能够自动化识别各种网络协议并产生模糊器进行Fuzz Testing的漏洞挖掘方法.这种方法通过报文分类、多序列比对、特定域识别、模糊器生成多个阶段,自动识别网络协议报文结构并进行Fuzz Testing.经过测试FTP、TNS、EM、ISQLPlus等多种已知和未知网络协议,结果表明这种方法在漏洞挖掘方面效果超过手工分析,并显著提升了测试效率,为提高网络协议的安全性提供了良好的基础,具有重要的应用价值.Along with the increasing complexity of the network application,network protocol security is now become more and more important.Fuzz Testing often is used to discover DoS,buffer overflow,format string and other kinds of serious vulnerabilities of network protocols.But manually Fuzz Testing is very low effective and need adequate detail information about the protocols.The paper presents an automatic vulnerability discovering method which combines automatic Protocol Reverse Engineering technology and Fuzz Testing.The method is a four steps program,involving packets clustering,multiple sequences alignment,special fields recognition and fuzzer production,which find the structure of network packets and pursue Fuzz Testing.After testing FTP,TNS,EM and ISQLPlus protocols,the results show that this method is more effective and accurate than manually analysis.The method is of the important application value and can improve the security of network protocols.

关 键 词：协议逆向工程 模糊测试 漏洞挖掘 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]