基于Fuzzing的网络协议漏洞挖掘技术研究  

Research on Network Protocol Vulnerability Mining Technology Based on Fuzzing

作　　者：尹誉衡 YIN Yuheng(North China Institute of Computing Technology,Beijing 100089,China)

机构地区：[1]华北计算技术研究所,北京100089

出　　处：《微型电脑应用》2021年第9期8-10,16,共4页Microcomputer Applications

基　　金：国家重点研发计划“公共安全风险防控与应急技术装备”重点专项(司法专题任务)(2018YFC0831200)。

摘　　要：网络的迅猛发展使得网络安全成为各界人士研究的热点。网络协议安全是网络安全的重要组成部分,不法分子可能会利用网络协议中存在的漏洞对企业和个人进行攻击,从而导致不可估量的后果。提出了一种基于Fuzzing的网络协议漏洞挖掘方法,设计并构建了一个网络协议模糊器。模糊器扩展了智能工具Sulley,增加网络数据包分析模块,提高测试用例生成的有效性。选取常用协议FTP协议作为实验对象,挖掘FTP协议漏洞。根据实验结果,改进后的模糊器可以有效触发FTP协议服务端漏洞,从而验证了该方法的有效性。The rapid development of the network makes network security become a hot topic for people life.Network protocol security is an important part of network security.Criminals may use loopholes in the network protocol to attack enterprises and individuals,resulting in immeasurable consequences.This paper adopts a method of mining network protocol vulnerabilities based on Fuzzing test,and designs and constructs a network protocol Fuzzer.The Fuzzer expands the intelligent tool Sulley,adds a network packet analysis module,and improves the effectiveness of test case generation.The commonly used protocol FTP protocol is selected as the experimental object,and the vulnerabilities of the FTP protocol are explored.According to the experimental results,the improved Fuzzer can effectively trigger the FTP protocol server vulnerabilities,thereby verifying the effectiveness of the method.

关 键 词：FUZZING测试 网络协议 漏洞挖掘 网络安全 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]