|
With more and more complex and important network applications , network protocol security requirements are also increasing. But how to test the security of the network protocol has been a very difficult problem . Fuzz Testing as an important means of testing , through the injection of large amounts of data to test the security of the network protocol , can find a denial of service , buffer overflows and format string and other important vulnerabilities. But manually Fuzz Testing requires precise understanding of network protocol details and construct a large number of test data sets , the workload is too heavy , leading to limited coverage , the effect is not good. To solve this problem , this paper combined with the network protocol reverse engineering and Fuzz Testing techniques , we propose a network protocol that automates identify and generate fuzzy controller for Fuzz Testing loophole mining method . The text used in the protocol reverse engineering method through packet classification , packet format recognition , state agencies and other stages made to achieve , in the absence of a priori knowledge of conditions to minimize the dependence on manual intervention , analysis of protocol packets format and protocol state machine , for in-depth understanding provides the basis for agreement . Binding protocol reverse engineering , the use of SPIKE network protocol fuzzing goals for automated generation . And the whole process without any manual intervention , greatly reducing the traditional Fuzz Testing required for testing complex and boring work . After testing FTP, TNS, EM, ISQLPlus other known and unknown network protocols, results show that this method results in vulnerability discovery aspect over hand , and significantly improve the test efficiency , to improve the security of the network protocol provides a good foundation , has important application value.
|