基于黑盒模糊测试的安全协议逻辑漏洞检测  

Security Protocol Logic Vulnerabilities Detection Based on Black-box Fuzzing

作　　者：赵栋梁 顾纯祥[1] 郑永辉[1] 张协力 ZHAO Dongliang;GU Chunxiang;ZHENG Yonghui;ZHANG Xieli(Information Engineering University,Zhengzhou 450001,China)

机构地区：[1]信息工程大学,河南郑州450001

出　　处：《信息工程大学学报》2025年第1期105-112,共8页Journal of Information Engineering University

摘　　要：针对安全协议实现中可能存在的逻辑错误,提出一种基于黑盒模糊测试的安全协议逻辑漏洞检测方法。将异常的协议交互行为建模为确定有限自动机(DFA),从模糊测试交互数据中提取抽象执行序列并判断其能否被DFA接受,以实现在黑盒条件下检测目标逻辑错误和异常行为的功能;基于DFA状态信息驱动测试序列生成,引导模糊测试探索深层协议状态空间,以提高模糊测试发现错误和异常的概率。基于该方法实现通用的黑盒协议模糊测试框架BDFuzz以及特定于IPsec协议的测试模块,在多个广泛应用的IPsec协议实现上进行实验,发现多个违反协议规范的异常行为和能够导致目标程序崩溃的漏洞。A security protocol logic vulnerability detection method based on black-box fuzz testing is proposed to address potential logical errors in the implementations of security protocols.In this method,abnormal protocol interaction behavior is modeled as a deterministic finite automaton(DFA).Abstract execution sequences are extracted from fuzz testing interaction data,and their acceptance by the DFA is determined for detecting target logical errors and abnormal behavior under black-box conditions.The generation of testing sequences is driven by DFA state information,guiding fuzz testing to explore deeper protocol state spaces and enhancing the probability of discovering errors and abnormalities.Based on this approach,a general black-box protocol fuzz testing framework,named BDFuzz,and a specific testing module for the IPsec protocol are implemented.Experimental results,conducted on multiple widely-used implementations of the IPsec protocol,reveal various abnormal behaviors violating protocol specifications and vulnerabilities capable of causing the target program to crash.

关 键 词：安全协议 密码协议 模糊测试 网络安全 漏洞挖掘 

分 类 号：TN918.1[电子电信—通信与信息系统]