高效的SIP服务器模糊测试方法  

An Efficient Fuzzing Test Method for SIP Servers

作　　者：王玉龙[1,2] 靳国栋[1] 王雨骄 

机构地区：[1]北京邮电大学网络与交换技术国家重点实验室,北京100876 [2]通信网信息传输与分发技术重点实验室,石家庄050081

出　　处：《北京邮电大学学报》2015年第4期10-14,共5页Journal of Beijing University of Posts and Telecommunications

基　　金：国家高技术研究发展计划(863计划)项目(2015AA017201);国家自然科学基金创新群体项目(61121061);网络与交换技术国家重点实验室自主课题(N2012002)

摘　　要：提出了一种高效的会话发起协议(SIP)服务器畸形消息测试方法.通过SIP栈源代码静态分析,建立危险库函数与SIP服务器接口的映射关系;通过SIP消息模板和畸形库,生成针对危险库函数的畸形消息集;通过攻击效果分析和变异、继承操作逐代优化畸形消息集,得到具有显著攻击效果的SIP畸形消息测试集.对所提方法的有效性进行了实验验证.An efficient fuzzing test method for session initiation protocol（ SIP） servers was proposed,compared to the conventional method,the generated number of malformed SIP messages was reduced,good attacking result was produced. It establishes mappings between dangerous library functions and interfaces of the SIP server through static source code analysis. It also obtains a set of malformed SIP messages targeting those dangerous functions. Finally,it optimizes the set of malformed SIP messages by analyzing its attack effects and generating better messages through inheritance and mutation operations,and obtains the set of messages having the most notable attack effects. Experiments are carried out to verify the effectiveness of the proposed method.

关 键 词：会话发起协议服务器 安全 畸形消息 模糊测试 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]