Wen Shameng, Meng Qingkun, Feng Chao, Tang Chaojing
College of Electronic Science and Engineering, National University of Defense Technology, Changsha, China.
PLoS One. 2017 Oct 19;12(10):e0186188. doi: 10.1371/journal.pone.0186188. eCollection 2017.
Network protocol vulnerability detection plays an important role in many domains, including protocol security analysis, application security, and network intrusion detection. In this study, by analyzing the general fuzzing method of network protocols, we propose a novel approach that combines network traffic analysis with the binary reverse engineering method. For network traffic analysis, the block-based protocol description language is introduced to construct test scripts, while the binary reverse engineering method employs the genetic algorithm with a fitness function designed to focus on code coverage. This combination leads to a substantial improvement in fuzz testing for network protocols. We build a prototype system and use it to test several real-world network protocol implementations. The experimental results show that the proposed approach detects vulnerabilities more efficiently and effectively than general fuzzing methods such as SPIKE.
网络协议漏洞检测在许多领域都发挥着重要作用，包括协议安全分析、应用程序安全和网络入侵检测。在本研究中，通过分析网络协议的通用模糊测试方法，我们提出了一种将网络流量分析与二进制逆向工程方法相结合的新颖方法。对于网络流量分析，引入了基于块的协议描述语言来构建测试脚本，而二进制逆向工程方法采用了遗传算法，其适应度函数旨在关注代码覆盖率。这种结合显著改进了网络协议的模糊测试。我们构建了一个原型系统，并使用它来测试几个实际的网络协议实现。实验结果表明，与SPIKE等通用模糊测试方法相比，所提出的方法能更高效、有效地检测漏洞。
