| 引用本文: | 袁斌,任家俊,陈群锦明,张驰,邹德清,金海.基于有限状态机引导的网络协议模糊测试方法.软件学报,2025,36(8):3726-3743 |
| |
|
| |
|
|
| 本文已被：浏览 1322次 下载 1890次 |
码上扫一扫！ |
|
|
| 基于有限状态机引导的网络协议模糊测试方法 |
|
袁斌1,2,3,4,5,6,7,8, 任家俊1,2,3,4,5, 陈群锦明1,2,3,4,5, 张驰1,2,3,4,5, 邹德清1,2,3,4,5,6, 金海1,2,9,10
|
|
1.大数据技术与系统国家地方联合工程研究中心(华中科技大学), 湖北 武汉 430074;2.服务计算技术与系统教育部重点实验室(华中科技大学), 湖北 武汉 430074;3.湖北省大数据安全工程技术研究中心(华中科技大学), 湖北 武汉 430074;4.分布式系统安全湖北省重点实验室(华中科技大学), 湖北 武汉 430074;5.华中科技大学 网络空间安全学院, 湖北 武汉 430074;6.金银湖实验室, 湖北 武汉 430040;7.嵩山实验室, 河南 郑州 452470;8.深圳华中科技大学研究院, 广东 深圳 518057;9.集群与网格计算湖北省重点实验室(华中科技大学), 湖北 武汉 430074;10.华中科技大学 计算机科学与技术学院, 湖北 武汉 430074
|
|
| 摘要: |
| 模糊测试技术能够自动化挖掘软件当中的漏洞, 然而目前针对网络协议的模糊测试工具对于协议实现内部状态空间探索有限, 导致覆盖率较低. 有限状态机技术能够对网络协议实现进行全方位建模, 以深入了解网络协议实现的系统行为和内部状态空间. 将有限状态机技术和模糊测试技术相结合, 提出一种基于有限状态机引导的网络协议模糊测试方法. 以广泛使用的TLS协议为研究对象, 利用有限状态机学习来对于TLS协议实现进行建模, 用来反映协议内部状态空间及其系统行为. 随后, 基于有限状态机对于TLS协议模糊测试进行引导, 使模糊测试的深度更深、覆盖代码更广. 为此, 实现一个原型系统SNETFuzzer, 并且通过一系列对比实验发现SNETFuzzer在覆盖率等重要指标中优于已有工作. SNETFuzzer在实验中成功发现多个漏洞, 其中包含两个新漏洞, 证明了其实用性和有效性. |
| 关键词: 软件测试 模糊测试 网络协议 有限状态机 |
| DOI：10.13328/j.cnki.jos.007260 |
| 分类号: |
| 基金项目:国家自然科学基金面上项目(62372191); 国家重点研发计划(2022YFB3103400) |
|
| Fuzz Testing Method for Network Protocols Guided by Finite State Machine |
|
YUAN Bin1,2,3,4,5,6,7,8, REN Jia-Jun1,2,3,4,5, CHEN Qun-Jin-Ming1,2,3,4,5, ZHANG Chi1,2,3,4,5, ZOU De-Qing1,2,3,4,5,6, JIN Hai1,2,9,10
|
|
1.National Engineering Research Center for Big Data Technology and System, Wuhan 430074, China;2.Services Computing Technology and System Lab (Huazhong University of Sicence and Technology), Wuhan 430074, China;3.Hubei Engineering Research Center on Big Data Security (Huazhong University of Science and Technology), Wuhan 430074, China;4.Hubei Key Laboratory of Distributed System Security (Huazhong University of Science and Technology), Wuhan 430074, China;5.School of Cyber Science and Engineering, Huazhong University of Science and Technology, Wuhan 430074, China;6.Jinyinhu Laboratory, Wuhan 430040, China;7.Songshan Laboratory, Zhengzhou 452470, China;8.Research Institute of Huazhong University of Science and Technology in Shenzhen, Shenzhen 518057, China;9.Cluster and Grid Computing Lab (Huazhong University of Science and Technology), Wuhan 430074, China;10.School of Computer Science and Technology, Huazhong University of Science and Technology, Wuhan 430074, China
|
| Abstract: |
| Fuzz testing automatically uncovers vulnerabilities in software. However, existing fuzz testing tools for network protocols are not able to fully explore their internal state space, resulting in limited coverage. Finite state machines comprehensively model the implementation of network protocols to provide an in-depth understanding of their system behavior and internal state space. This study proposes a fuzz testing method for network protocols based on finite state machines. It focuses on the commonly used TLS protocol, using finite state machine learning to model the implementation of the TLS protocol, reflecting the protocol’s internal state space and system behavior. Subsequently, guided by finite state machines, the fuzz testing of the TLS protocol achieves deeper depth and broader code coverage. This study also implements a prototype system, SNETFuzzer, which outperforms existing methods in important metrics such as coverage in a series of comparative experiments. SNETFuzzer successfully discovers multiple vulnerabilities, including two new ones, demonstrating its practicality and effectiveness. |
| Key words: software testing fuzz testing network protocol finite state machine |
|
|
|
|
