期刊文献+

网络协议软件漏洞挖掘技术综述 被引量:4

Survey on Vulnerability Mining Techniques of Network Protocol Software
下载PDF
导出
摘要 网络协议软件部署和应用非常广泛,在网络空间提供了诸如通信、传输、控制、管理等多样化的功能.近年来,其安全性逐渐受到学术界和工业界的重视,及时发现和修补网络协议软件漏洞,成为一项重要的课题.网络协议软件由于部署形态多样、协议交互过程复杂、相同协议规范的多个协议实现存在功能差异等特点,使得其漏洞挖掘技术面临诸多挑战.首先对网络协议软件漏洞挖掘技术进行分类,对已有关键技术的内涵进行界定.其次,进一步综述网络协议软件漏洞挖掘4个方面的技术进展,包括网络协议描述方法、挖掘对象适配技术、模糊测试技术和基于程序分析的漏洞挖掘方法,通过对比分析归纳不同方法的技术优势及评价维度.最后,总结网络协议软件漏洞挖掘的技术现状和挑战,并提炼5个潜在研究方向. The network protocol software is widely deployed and applied,and it provides diversified functions such as communication,transmission,control,and management in cyberspace.In recent years,its security has gradually attracted the attention of academia and industry.Timely finding and repairing network protocol software vulnerabilities has become an important topic.The features,such as diversified deployment methods,complex protocol interaction processes,and functional differences in multiple protocol implementations of the same protocol specification,make the vulnerability mining technique of network protocol software face many challenges.This study first classifies the vulnerability mining technologies of network protocol software and defines the connotation of existing key technologies.Secondly,this study summarizes the technical progress in four aspects of network protocol software vulnerability mining,including network protocol description method,mining object adaptation technology,fuzz testing technology,and vulnerability mining method based on program analysis.In addition,through comparative analysis,the technical advantages and evaluation dimensions of different methods are summarized.Finally,this study summarizes the technical status and challenges of network protocol software vulnerability mining and proposes five potential research directions.
作者 喻波 苏金树 杨强 黄见欣 盛周石 刘润昊 卢建君 梁晨 陈晨 赵磊 YU Bo;SU Jin-Shu;YANG Qiang;HUANG Jian-Xin;SHENG Zhou-Shi;LIU Run-Hao;LU Jian-Jun;LIANG Chen;CHEN Chen;ZHAO Lei(College of Computer Science and Technology,National University of Defense Technology,Changsha 410073,China;School of Cyber Science and Engineering,University of Wuhan,Wuhan 430072,China)
出处 《软件学报》 EI CSCD 北大核心 2024年第2期872-898,共27页 Journal of Software
基金 国家自然科学基金(61902416) 湖南省自然科学基金(2019JJ50729)。
关键词 网络协议软件 漏洞挖掘 模糊测试 程序分析 符号执行 network protocol software vulnerability mining fuzz testing program analysis symbolic execution
  • 相关文献

参考文献8

二级参考文献68

  • 1陈星,贾卓生.工业控制网络的信息安全威胁与脆弱性分析与研究[J].计算机科学,2012,39(S2):188-190. 被引量:29
  • 2张宝峰,张翀斌,许源.基于模糊测试的网络协议漏洞挖掘[J].清华大学学报(自然科学版),2009(S2):2113-2118. 被引量:14
  • 3刘立芳,霍红卫,王宝树.PHGA-COFFEE:多序列比对问题的并行混合遗传算法求解[J].计算机学报,2006,29(5):727-733. 被引量:11
  • 4ProxyFuzz [EB/OL]. http://www, darknet, org. uk/2007/06/ proxy fuzz-mitre-network- fuzzer-in-python/.
  • 5SPIKE Proxy[EB/OL]. http://www, immunitysec, com/resou-rcesfreesoftware.
  • 6Milani C P, Gilbert W, Christopher K, et al. Prospex: protocol specification extraction[C]//Proc, of the 30th IEEE Symposium on Security and Privacy. Oakland,California,USA,2009 : 110-125.
  • 7Tsankov P, Dashti M T, Basin D. SECFUZZ: Fuzz-testing securi- ty protocols [C]//Proc. of the 7th International Workshop on Automation of Software Test(AST). Zurich, Switzerland, 2012.
  • 8Caballero J,Johnson N, McCamant S, et al. Binary code extrac- tion and interface identification for security applications[C]// Proc of the 16th ACM Conference on Computer and Communi- cations Security(CCS). Chicago, USA, 2009.
  • 9Wang T,Wei T, Zou W. TaintScope: a checksum-aware directed fuzzing tool for automatic software vulnerability detection[C]// Proc. of the 31st IEEE Symposium on Security & Privacy (S&P). Oakland, California, USA, 2010.
  • 10Godefroid P, Levin M Y, Molnar D. Automated whitebox fuzz testing[C]//Proc, of the 16th Network and Distributed System Security(NDSS). California, USA, 2008.

共引文献134

同被引文献14

引证文献4

相关作者

内容加载中请稍等...

相关机构

内容加载中请稍等...

相关主题

内容加载中请稍等...

浏览历史

内容加载中请稍等...
;
使用帮助 返回顶部