期刊文献+
任意字段
题名或关键词
题名
关键词
文摘
作者
第一作者
机构
刊名
分类号
参考文献
作者简介
基金资助
栏目信息

基于状态模型的IMS网络SIP协议流程漏洞挖掘 被引量：2

Vulnerability discovery method of SIP procedures in IMS network based on state model
下载PDF
导出
摘要 为有效发现IMS网络中SIP协议流程的脆弱性,提出一种基于状态模型的SIP协议流程漏洞挖掘方法。在分析协议流程的基础上研究状态图的生成方法,设计基于状态图的漏洞挖掘模型,针对不同类型的脆弱性分别研究测试消息注入方法和异常响应监控方法。实验及分析结果表明,该方法覆盖率更高,能够进入协议执行流程内有效挖掘SIP协议流程漏洞。 To discover and patch the SIP vulnerabilities in IMS network effectively,a vulnerability discovery method was proposed based on state model.First,a method was researched to build state diagram on the basis of protocol procedure analysis.Then a vulnerability discovery model was designed based on the state diagram.Finally,methods of injecting test messages and monitoring abnormal response for different vulnerabilities were discussed.The results of experiment and analysis show that this method can make a better test coverage and go deep into the performed procedure of protocols to discover SIP procedure vulnerabilities effectively.
作者 刘彩霞 潘准洋 郭严赞
机构地区 国家数字交换系统工程技术研究中心
出处 《计算机工程与设计》 CSCD 北大核心 2014年第12期4160-4164,共5页 Computer Engineering and Design
基金 2012年重大专项基金项目(2012ZX03006002-013)
关键词 IP多媒体子系统 会话初始协议 网络安全 漏洞挖掘 状态模型 IP multimedia subsystem（IMS） session initiation protocol（SIP） network safety vulnerability discovery state model
分类号 TP393.08 [自动化与计算机技术—计算机应用技术]
  • 相关文献

参考文献10

  • 1Mahmood F.SIP security threats and countermeasures[D].Sweden:Halmstad University,2012.
  • 2WANG Yulong,WANG Dong,WANG Lei.A parsing mode based method for malformed SIP messages testing for IMS network[J].Journal of Networks,2013,8(4):812-821.
  • 3刘树新,彭建华,刘彩霞,谢晓龙.基于Fuzz测试的IMS网络SIP漏洞挖掘模型[J].计算机应用研究,2012,29(9):3456-3459. 被引量：1
  • 4Abdelnur H J,State R,Festor O.KiF:A stateful SIP fuzzer[C]//Proceedings of the 1st International Conference on Principles,Systems and Applications of IP Telecommunications.New York:ACM,2007:47-56.
  • 5Ehlert S,Geneiatakis D,Magedanz T.Survey of network security systems to counter SIP-based denial-of-service attacks[J].Computers&Security,2010,29(2):225-243.
  • 6Abrey D D,Ventura N.Vulnerability discovery and analysis within the open source IMS core[C]//The Southern Africa Telecommunication Networks and Applications Conference,2011:4-7.
  • 7Srinivasan H,Sarac K.A SIP security testing framework[C]//The 6th Consumer Communications and Networking Conference.Las Vegas:IEEE,2009:1-5.
  • 8HSU Y,SHU Guoqiang,LEE David.A model-based approach to security flaw detection of network protocol implementations[C]//IEEE International Conference on Network Protocols.Orlando:IEEE,2008:114-123.
  • 9Duchene F,Groz R,Rawat S,et al.XSS vulnerability detection using model inference assisted evolutionary fuzzing[C]//The Third International Workshop on Security Testing.Canada:IEEE,2012:815-817.
  • 10Ali S,Briand L C,Hemmati H,et al.A systematic review of the application and empirical investigation of search-based test case generation[J].IEEE Transactions on Software Engineering,2010,36(6):742-762.

二级参考文献14

  • 1KUMAR A,TILAGAM S. A novel approach for evaluating and detecting low rate SIP flooding attack [J]. International Journal of Computer Application,2011,26(1) :31-36.
  • 2CHEN E Y, ITOH M. A whitelist approach to protect SIP servers from flooding attacks [ C]//Proc of IEEE Intemationai Workshop Technical Committee on Communications Quality and Reliability. 2010 : 1 - 6.
  • 3SC HANES C,TABER S,POPP K,et al. Security test approach for automated detection of vulnerabilities of SIP-based VoIP so￡tphones[ J]. International Journal on Advances in Security,2011,4(1-2) :95-105.
  • 4CHOWOHURY M Z,SY B K,AHMAD R. Application of gassian estimation for devising reliable vulnerability assessment on SIP-based VOIP infrastructure [ C ] //Proc of Intemationai Conference on Security & Management. 2006 : 293-299.
  • 5GORBUNOU S,ROSENBLOOM A. AutoFuzz:automated network protocol fuzzing framework [J]. International Journal of Computer Science and Network Security,2010,10(8) :239-245.
  • 6CAMARILLO G, GARCIA-MARTIN M A. The 3G IP multimedia subsystem (IMS) :merging the internet and the cellular worlds[ M]. 2nd ed. Chichester : John Wiley ,2006 :31-40.
  • 7SHUANG Kai,WANG Si-yuan,ZHANG Bo, et al. IMS security analysis using multi-atttibute model [ J ]. Journal of Networks, 2011,6 (2) :263-271.
  • 8BECKER S, ABDELNUR H, OBES J L, e( al. Improving fuzz testing using game theory [ C ] //Proc of the 4 th Intemationai Conference on Network and System Security,Melbourne,Australia. Washington DC: IEEE Computer Society, 2010 : 263 - 268.
  • 9DAI Hu-ning, MURPHY C, KAISER G E. Configuration fuzzing for software vulnerability detection [ C ] //Proc of International Conference on Availability,Reliability and Security.2010;525-530.
  • 10TAKANEN A, DeMOTT J, MILLER C. Fuzzing for software security testing and quality assurance [ M ]. Norwood,MA .. Artech House, 2008:22-32.

同被引文献19

引证文献2

二级引证文献5

计算机工程与设计
2014年 第12期

相关作者

内容加载中请稍等...

相关机构

内容加载中请稍等...

相关主题

内容加载中请稍等...

浏览历史

内容加载中请稍等...
;
使用帮助 返回顶部