Protocol service program amplification vulnerability mining method and system based on state guidance

Abstract

The invention relates to the technical field of program vulnerability mining, in particular to a protocol service program amplification vulnerability mining method and system based on state guidance, and the method comprises the steps: obtaining the termination branch position information of a protocol service program through static analysis; according to termination branch position information generated by static analysis, codes of coverage rate feedback and program running state perception are inserted into the program, and a tested protocol service program is obtained; and carrying out fuzzy test circulation on the program after instrumentation, carrying out test case selection by utilizing a seed selection method based on amplification coefficient feedback, and carrying out test case variation by utilizing a seed variation strategy with maximized amplification vectors so as to mine amplification vulnerabilities in the protocol service program. According to the method, the running state of the protocol service program is obtained by using static analysis and a lightweight instrumentation technology, and seed selection is guided by adding a seed variation strategy for maximizing an amplification vector and using a session-based bandwidth amplification coefficient, so that the mining effect of an amplification vulnerability is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of program vulnerability mining, and in particular to a method and system for mining protocol service program amplification vulnerabilities based on state guidance. Background Art

[0002] Over the years, amplification-based distributed denial of service attacks have gradually become a powerful DDoS attack strategy. According to the 2023 Global DDoS Attack Status and Trend Analysis Report released by Tsinghua University, Huawei and other companies, the frequency of DDoS attacks continues to grow. After analyzing attacks with traffic exceeding 100Gbps, it was found that UDP reflection and UDPFlood attacks are the main means for attackers to launch large-volume attacks, and TCP reflection and SYN Flood attacks also account for a large proportion. Among them, amplification vulnerabilities are one of the main causes of ADDoS attacks. Therefore, it is of great value to conduct research on automated mining methods for amplification vulnerabilities.

[0003] However, current vulnerability mining research mainly focuses on memory corruption vulnerabilities, command injection vulnerabilities, etc., and lacks mining methods for amplification vulnerabilities. The reason is that compared with other vulnerability types, amplification vulnerabilities are more difficult to discover because they cannot be discovered by directly observing the running status of the program. For program crash errors, we usually only care about whether a certain type of request will trigger a crash, but for amplification vulnerabilities, we pay more attention to the ratio of the payload of the response message to the payload of the request message. In 2022, Krupp et al. first proposed a systematic method for mining amplification vulnerabilities in network services based on the UDP protocol - AMPFUZZ, which is based on the most advanced gray-box fuzz testing tools and significantly improves the efficiency of fuzz testing through UDP state awareness technology.

[0004] The proposal of AMPFUZZ provides a new idea and solution for the mining of amplification vulnerabilities. However, the following problems still exist in current research: ①AMPFUZZ does not consider the state information of the protocol during fuzz testing, making it difficult to discover amplification vulnerabilities based on state transformation. ②Current research usually uses BAF (bandwidth amplification factor) as the evaluation criterion for amplification vulnerabilities. However, for amplification vulnerabilities of state transformation, using BAF as an evaluation indicator is not reasonable. ③For protocol fuzz testing, most existing methods rely on manually set timeouts to start or end a request. On the one hand, this may cause some requests to be discarded by the server, and on the other hand, it will also reduce the efficiency of fuzz testing. ④AMPFUZZ only considers amplification vulnerabilities based on the UDP protocol, and does not support the mining of amplification vulnerabilities based on the TCP protocol. In recent years, some reports have also pointed out that ADDoS attacks based on the TCP protocol are becoming rampant, so a general amplification vulnerability mining framework is needed to solve this problem. Summary of the invention

[0005] The present invention aims to solve the above defects in the prior art, and proposes a state-guided protocol service program amplification vulnerability mining method and system, which utilizes static analysis and lightweight instrumentation technology to obtain the running state of the protocol service program, and adds a seed mutation strategy that maximizes the amplification vector, and uses a session-based bandwidth amplification factor to guide the selection of seeds, thereby improving the mining effect of the amplification vulnerability.

[0006] To achieve the above purpose, the technical solution adopted is:

[0007] A method for mining protocol service program amplification vulnerabilities based on state guidance, comprising:

[0008] Use the LLVM compiler to convert the source code into LLVM intermediate instructions, and obtain the termination branch location information of the protocol service program through static analysis;

[0009] According to the termination branch position information generated by static analysis, the coverage feedback and the program running status perception code are inserted into the program to obtain the protocol service program under test;

[0010] A fuzz testing cycle is performed on the instrumented program, and a seed selection method based on amplification factor feedback is used to select test cases. A seed mutation strategy that maximizes the amplification vector is used to mutate test cases, thereby discovering amplification vulnerabilities in protocol service programs.

[0011] According to the state-guided protocol service program amplification vulnerability mining method of the present invention, further, static analysis includes a semaphore synchronization mechanism based on shared memory to control the interaction process between the fuzzifier and the protocol service program under test, and the interaction process is: when the protocol service program is executed, it will first be in a listening state, waiting for a connection from the fuzzifier, and at the same time increase the semaphore in the shared memory; then, after waiting for the semaphore to increase, the fuzzifier will initiate a connection request to the protocol service program under test, and at the same time reduce the semaphore in the shared memory; until the fuzzifier receives a response message sent by the protocol service program under test or ends an interaction due to a reception timeout.

[0012] According to the state-guided protocol service program amplification vulnerability mining method of the present invention, further, the static analysis also includes termination branch identification based on taint analysis, and the termination branch identification process is: ① all basic blocks that call Source class functions are regarded as source points, and all basic blocks that call Sink class functions are regarded as sink points; ② determine which basic blocks can reach the sink point after the source point, and call these basic blocks basic blocks with sink capability, and the sink point itself is also regarded as a basic block with sink capability; ③ the edge composed of the basic block with sink capability to the basic block without sink capability is the termination branch.

[0013] According to the state-guided protocol service program amplification vulnerability mining method of the present invention, further, the program running state perception code is inserted into the program to include:

[0014] Traverse each basic block in the protocol service program, obtain the ID information of the last instruction of the basic block, and then traverse all subsequent basic blocks of the basic block, and obtain the ID information of the first instruction of all subsequent basic blocks, compare each edge with the termination branch position information, and when the basic block position where the termination branch is located is found, an instruction calling the terminate function will be inserted after the basic block to complete the stub process.

[0015] According to the state-guided protocol service program amplification vulnerability mining method of the present invention, further, the amplification factor adopts a session-based bandwidth amplification factor, which is defined as follows: In a fuzzy test process, assuming that the fuzzer sends m messages to the protocol service program under test, and the size of each message is len (Request payload i ), i represents the i-th request message; the fuzzer receives n messages from the protocol service program under test, and the size of each response message is len(Response payload j ), j represents the jth response message, and its calculation formula is:

[0016]

[0017] According to the state-guided protocol service program amplification vulnerability mining method of the present invention, further, using the seed selection method based on amplification factor feedback to select test cases includes:

[0018] Traverse all seeds under the selected protocol state, sort the seeds in descending order according to BAFmsg, calculate the ratio of the seed index to the number of seeds under all selected protocol states to get the probability of the seed being selected; select the seed with a larger BAFmsg by setting a lower limit on the probability.

[0019] According to the state-guided protocol service program amplification vulnerability mining method of the present invention, further, using the seed mutation strategy of maximizing the amplification vector to perform test case mutation includes:

[0020] The fuzzer finds a candidate seed with BAFmsg greater than 1 and mutates the seed by deleting bytes one by one from the end of the candidate seed or at the position of the specified delimiter.

[0021] Furthermore, the present invention also proposes a state-guided protocol service program amplification vulnerability mining system, which includes a static analysis module, a stub compilation module and a fuzzy testing module, wherein:

[0022] The static analysis module is used to convert the source code into LLVM intermediate instructions using the LLVM compiler, and obtain the termination branch location information of the protocol service program through static analysis;

[0023] The stub compilation module is used to insert coverage feedback and program running status perception code into the program according to the termination branch location information generated by static analysis to obtain the protocol service program under test;

[0024] The fuzz testing module is used to perform fuzz testing cycles on the instrumented program, select test cases using a seed selection method based on amplification factor feedback, and mutate test cases using a seed mutation strategy that maximizes the amplification vector, thereby exploring amplification vulnerabilities in protocol service programs.

[0025] The beneficial effects achieved by adopting the above technical solution are:

[0026] Previous protocol fuzzers aim to find inputs that cause protocol service programs to crash, but rarely consider other types of errors. AMPFUZZ is the first systematic method to mine amplification vulnerabilities in UDP-based network services, but unfortunately it does not consider amplification vulnerabilities caused by protocol state changes, and it is limited to the UDP protocol. In view of this, the present invention proposes a state-guided protocol service program amplification vulnerability mining method, which guides fuzz testing through protocol state and uses session-based bandwidth amplification factors to guide seed selection, so as to more effectively mine amplification vulnerabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings of the embodiments of the present invention, wherein the drawings are only used to illustrate some embodiments of the present invention, but not to limit all embodiments of the present invention thereto.

[0028] Figure 1 It is a flow chart of a method for exploiting protocol service program amplification vulnerabilities based on state guidance according to an embodiment of the present invention;

[0029] Figure 2 is a schematic diagram of a semaphore synchronization process according to an embodiment of the present invention;

[0030] Figure 3 is a schematic diagram of a stain analysis process according to an embodiment of the present invention;

[0031] Figure 4 is a schematic diagram of termination branch identification based on stain analysis according to an embodiment of the present invention;

[0032] Figure 5 is a workflow diagram of the instrumentation compilation according to an embodiment of the present invention;

[0033] Figure 6 This is a schematic diagram of OpenSLP#1 traffic amplification according to an embodiment of the present invention;

[0034] Figure 7 This is a comparison diagram of the magnification vector of Memcached#4 between AFLAMP and AMPFUZZ according to an embodiment of the present invention;

[0035] Figure 8 It is a diagram of the LightFTP traffic amplification process of an embodiment of the present invention. DETAILED DESCRIPTION

[0036] The following will be combined with the drawings of specific embodiments of the present invention to clearly and completely describe the exemplary scheme of the embodiment of the present invention. Unless otherwise defined, the technical terms or scientific terms used in the present invention should be the common meanings understood by people with ordinary skills in the field.

[0037] In order to automatically find amplification vulnerabilities in protocol service programs, this embodiment discloses a protocol service program amplification vulnerability mining method AFLAMP based on state guidance, such as Figure 1 As shown, it contains the following contents:

[0038] Step S101: Use the LLVM compiler to convert the source code into LLVM intermediate instructions, and obtain the termination branch position information of the protocol service program through static analysis for use in compiling and inserting.

[0039] The protocol service program is usually a C / S architecture program. When developing the service program using languages ​​such as C / C++, the corresponding network API is used to create and manage network connections. Taking the TCP protocol as an example, a complete network communication process includes: creating a socket, binding a socket, listening for connections, accepting connections, reading (recv) and sending (send) data, and closing connections (close). When the protocol service program is running, it will initially be blocked in the state of accepting connections, waiting for connections from the client. When the client successfully connects, the protocol service program will usually be blocked in the state of reading data until it receives input from the client. If the protocol service program is not in the corresponding blocking state and receives requests from the client, these requests will be ruthlessly discarded.

[0040] In network programming, in order to solve the problem of multiplexing, developers will use select and poll related network APIs to write network service programs. The select function allows the program to monitor multiple file descriptors and wait for one or more file descriptors to become "ready", that is, they have data to read, write or errors to be processed. The poll function is an alternative to the select function, which solves the limitation on the number of file descriptors. For ease of explanation, network functions are divided into three categories, as shown in Table 1. Source class: all functions that have the function of receiving data packets; Sink class: all functions that have the function of sending data packets; Block class: all functions that can block the current process while waiting to receive data. Among them, the accept function, although it is not used to wait for receiving data, is still classified into the Block class.

[0041] Table 1 Classification of network functions

[0042]

[0043] (1) Semaphore synchronization mechanism based on shared memory

[0044] In order to improve the efficiency of fuzz testing, reduce the time that the service program is blocked, and avoid the client's request being discarded by the protocol service program, this embodiment proposes a semaphore synchronization mechanism based on shared memory to control the interaction process between the fuzzer and the protocol service program under test. Before the fuzzer executes a test case, it first initializes the shared memory and binds the shared memory to the semaphore, and then passes the shared memory ID to the protocol service program under test through the environment variable, and uses the LD_PRELOAD mechanism to HOOK related network functions so that the program under test can execute custom code. When the program under test executes to the Source class or Block class function, the value of the current semaphore will be obtained through the shared memory ID, and the semaphore will be increased to inform the fuzzer "I am ready." Figure 2 The semaphore synchronization process between the fuzzer and the protocol service program under test is demonstrated.

[0045] When the protocol service program is executed, it will first be in a listening state, waiting for a connection from the fuzzer, and at the same time increase the semaphore in the shared memory to inform the fuzzer "I am ready". Then, after waiting for the semaphore to increase, the fuzzer will initiate a connection request to the protocol service program under test, and at the same time reduce the semaphore in the shared memory to inform the protocol service program under test "I have initiated a connection request". The fuzzer initiates a request message to the protocol service program under test, see the above interaction process. Until the fuzzer receives a response message sent by the protocol service program under test or ends an interaction due to a reception timeout.

[0046] (2) Termination branch identification based on taint analysis

[0047] On the one hand, after receiving a request, the protocol service program will determine whether to send a response based on the current protocol status and the content of the received request. Regardless of whether it is sent or not, the protocol service program will usually perform logging or data cleaning operations afterwards, which are meaningless for fuzz testing. On the other hand, for the discovery of amplified vulnerabilities, this case solution pays more attention to those branches that can reach Sink-like functions. For those branches that cannot reach Sink-like functions, they should be actively terminated in advance, rather than relying on expensive timeouts, in order to improve the execution efficiency of fuzz testing. This case solution uses taint analysis technology combined with the program's control flow graph and function call graph to identify these termination branches.

[0048] In the subsequent instrumentation process, it is usually necessary to compare the location information of the instruction to find the instrumentation location. The location information of the instruction is usually a string similar to "file:source.c,loc:222", but string comparison is often slower than numerical comparison. Therefore, in order to facilitate faster comparison of instruction location information in the subsequent instrumentation process, a unique ID value is assigned to each intermediate instruction during the static analysis process and stored in the metadata of the instruction for use in subsequent instrumentation.

[0049] All basic blocks that call Source class functions are considered source points, and all basic blocks that call Sink class functions are considered sink points. In order to find the terminal branch, we first need to determine which basic blocks can reach the sink point after the source point, and these basic blocks are called sink-capable basic blocks. The sink point itself is also considered a sink-capable basic block. In general, sink-capable basic blocks include the following two categories: ① Basic blocks that call Sink class functions; ② Basic blocks that do not call Source class functions and have at least one sink-capable basic block as a successor. The edges from sink-capable basic blocks to non-sink-capable basic blocks are terminal branches.

[0050] In order to find the basic blocks with sink capability in the program, it is necessary to traverse all strongly connected components (SCC) of the function call graph, and then traverse each function and basic block in each SCC. Figure 3 As shown in -a, since the recvfrom function is called in basic block A and the send function is called in basic block E, basic block A is the source point and basic block E is the sink point. All successor nodes of basic block A are iterated. If there is a path to the sink point, these basic blocks are marked as basic blocks with sink capability (such as basic blocks B, C, and D). The analysis between functions is as follows Figure 3 -b, basic block A is the source point, basic block H is the sink point, and basic block C calls function B. In function B, since the first basic block F of function B can reach the sink point, all basic blocks that call function B have a path to the sink point, so basic block C is a basic block with sink capability.

[0051] After finding the basic blocks with sink capability in the program, determine which branches are terminal branches, and then output the location information of the terminal branches for subsequent instrumentation compilation.

[0052] Figure 4This paper shows how to identify the termination branch on a typical protocol service program. The protocol service program first performs some initialization operations (such as initializing the socket), and then the main function enters a loop body, continuously waiting for connections from the client and calling the corresponding processing function for each request from the client. The processing function checks the request to determine whether to send a response. Finally, after the termination branch is identified, Figure 4 The red branches in will be marked as terminal branches.

[0053] Step S102: insert coverage feedback and program running status perception code into the program according to the termination branch position information generated by static analysis to obtain the protocol service program under test.

[0054] After analyzing the intermediate instructions of the target protocol service program through static analysis, the stub compilation is responsible for further processing the target code and generating the final protocol service program under test for the fuzzer to use. The stub compilation module will perform lightweight stubs on the target according to the termination branch location information generated by static analysis, and finally obtain the protocol service program under test with the ability to perceive the program running status. The workflow of stub compilation is as follows: Figure 5 shown.

[0055] In order to realize the running state awareness capability of the protocol service program under test, the instrumentation compiler injects additional terminate code into the corresponding termination branch according to the termination branch location information of the program. Algorithm 1 describes the process of program running state awareness instrumentation.

[0056] Algorithm 1 Program running state awareness instrumentation algorithm

[0057] Input Source, Loc

[0058] Output null

[0059] 1) ins_id ← 0;

[0060] 2)for each Function F in Source do

[0061] 3)for each BasicBlockBB in F do

[0062] 4)cur_id←BB.front().getMetadata();

[0063] 5)for each Successor S in successors(BB)do

[0064] 6)next_id←S.front().getMetadata();

[0065] 7)if tuple(cur_id,next_id)==Loc then

[0066] 8)Instrument call to terminate function

[0067] 9)end if

[0068] 10) end for

[0069] 11) end for

[0070] 12) end for

[0071] In the above-mentioned instrumentation algorithm, the instrumentation compiler will traverse each basic block in the protocol service program, obtain the ID information of the last instruction of the basic block, and then traverse all subsequent basic blocks of the basic block, and obtain the ID information of the first instruction of all subsequent basic blocks, and compare each edge with the termination branch position information. When the basic block position where the termination branch is located is found in this way, an instruction calling the terminate function will be inserted after the basic block to complete the instrumentation process. After completing the program running state awareness instrumentation, the obtained protocol service program under test after instrumentation can decide whether to end the current thread after processing each request message, thereby improving the efficiency of fuzz testing.

[0072] Step S103, perform a fuzzy test cycle on the program after being plugged, use a seed selection method based on amplification coefficient feedback to select test cases, and use a seed mutation strategy that maximizes the amplification vector to mutate the test cases, so as to discover amplification vulnerabilities in the protocol service program.

[0073] (1) Session-based bandwidth amplification factor

[0074] In order to focus on the amplification vector based on state transition, the fuzzer must be able to measure the ratio between multiple request sequences and multiple response sizes. To this end, this solution proposes a session-based bandwidth amplification factor (BAFmsg) based on BAF. In a fuzz test, suppose the fuzzer sends m messages to the protocol service program under test, and the size of each message is len(Request payload i ), i represents the i-th request message; the fuzzer receives n messages from the protocol service program under test, and the size of each response message is len(Response payload j ), j represents the jth response message, and its calculation method is shown in formula (1):

[0075]

[0076] (2) Seed selection method based on amplification factor feedback

[0077] AFLAMP uses a variety of heuristic methods for seed selection. These heuristic methods are selected based on the relevant statistical data in the constructed protocol state model and the amplification factor fed back by the tested service program to help the fuzzer select seeds that are more likely to increase the amplification factor in the specified target state. AFLAMP records all seeds that can reach this state in each state, and records the BAFmsg that can be triggered by the seed in each seed. For seeds with larger amplification factors, it is more likely to obtain amplification vectors with larger amplification factors after the seed mutation strategy that maximizes the amplification vector, and these seeds should be given a higher probability of being selected.

[0078] To this end, this case scheme adds a method based on amplification factor feedback on the basis of AFLNET's seed selection method. Traverse all seeds in the selected protocol state, sort the seeds in descending order according to BAFmsg, and calculate the ratio of the seed index to the number of seeds in all selected protocol states to obtain the probability of the seed being selected. At the same time, in order to focus on the top 20% of the seeds in the sorting results, AFLAMP refers to AFLNET's heuristic method by setting a lower limit on the probability to avoid frequently selecting seeds with smaller BAFmsg. It is worth noting that AFLAMP will only start applying these heuristic methods after the fuzz testing process has run long enough to accumulate statistical data. At the beginning, the seed selector uses a round-robin scheduling method to select the target seed.

[0079] The seed selection method based on amplification factor feedback is shown in Algorithm 2.

[0080] Algorithm 2 Seed selection algorithm based on amplification factor feedback

[0081] Input State

[0082] Output Seed

[0083] 1) ins_id ← 0;

[0084] 2) seeds_count←State.seeds_count;

[0085] 3) if seeds_count>10:

[0086] 4)Sort(State.BAFmsg)

[0087] 5) for each Seed S in State do

[0088] 6)p←(1-Index(S) / seeds_count)*100;

[0089] 7)if UR(100)<p&&p> 80:

[0090] 8)returnS

[0091] 9)end if

[0092] 10) end for

[0093] 11) else

[0094] 12)Send←State.seeds[idx++%seeds_count]

[0095] 13)returnS

[0096] (3) Seed mutation strategy using the maximum amplification vector

[0097] From the calculation formula of BAFmsg, we can know that in order to increase BAFmsg, one method is to reduce the number or size of request messages while keeping the number and size of response messages unchanged; another method is to modify the request message to increase the number or size of response messages. By analyzing common protocol service programs, the following observations are made: For many protocol service programs, the request content is often obtained through a specified delimiter, and there is usually an additional optional field after the command ends. AFLAMP uses a simple and effective seed mutation strategy to maximize the amplification vector. Once the fuzzer finds a seed with BAFmsg greater than 1, the seed is mutated by deleting bytes one by one from the end of the candidate seed or the position of the specified delimiter. This is very helpful for maximizing the amplification vector and can help the fuzzer find the minimum request that can receive the same response in the current state.

[0098] For example, FTP is a commonly used file transfer protocol. When communicating between FTP clients and servers, CRLF is usually used as line separators. When the client sends a "HELP\r\n" request, the server will respond with relevant help information. At this time, BAFmsg is greater than 1. In the subsequent seed mutation process, the bytes before the separator will be deleted one by one. Finally, it will be found that the "H\r\n" request can also lead to the same response, thereby maximizing the amplification vector.

[0099] Corresponding to the above method, this embodiment also proposes a state-guided protocol service program amplification vulnerability mining system, which includes a static analysis module, a stub compilation module and a fuzz testing module, wherein:

[0100] The static analysis module is used to convert the source code into LLVM intermediate instructions using the LLVM compiler, and obtain the termination branch location information of the protocol service program through static analysis.

[0101] The stub compilation module is used to insert coverage feedback and program running status perception code into the program according to the termination branch location information generated by static analysis to obtain the protocol service program under test.

[0102] The fuzz testing module is used to perform fuzz testing cycles on the instrumented program, select test cases using a seed selection method based on amplification factor feedback, and mutate test cases using a seed mutation strategy that maximizes the amplification vector, thereby exploring amplification vulnerabilities in protocol service programs.

[0103] This paper evaluates AFLAMP by setting up various experiments to demonstrate its ability in mining amplification vulnerabilities and the advantages of the state-guided protocol service program amplification vulnerability mining method; it attempts to answer the following research questions:

[0104] RQ1: Can AFLAMP discover unknown amplification vulnerabilities / amplification vectors?

[0105] RQ2: Compared with the existing amplification vulnerability mining method AMPFUZZ, how effective is the method AFLAMP proposed in this case?

[0106] To answer RQ1 and RQ2, AFLAMP and AMPFUZZ are run on a set of targets to evaluate their amplification vulnerability mining capabilities, which include service programs with known amplification vulnerabilities.

[0107] RQ3: Can protocol state guidance help discover more amplification vulnerabilities?

[0108] To this end, the experiment compared the number of amplification vulnerabilities that AFLAMP could find when booted with and without AFLAMP enabled.

[0109] 1. Experimental setup

[0110] Since AFLAMP is a state-guided fuzzer, stateful protocol servers are given priority when collecting targets. Protocol servers based on UDP are generally considered stateless, but there are some exceptions. TFTP is a stateful file transfer protocol based on UDP. It ensures that files can be reliably transmitted on the unreliable UDP protocol through internal state management and simple control protocols. Memcached is a high-performance distributed memory object caching system. Before obtaining a key value, the corresponding data must be set first. This behavior can also be considered a state.

[0111] Some programs in the ProFuzzBench and AMPFUZZ datasets are selected as test targets. ProFuzzBench includes a variety of application layer protocol service programs based on different transport layer protocols (TCP and UDP). The experimental targets of AMPFUZZ include protocols with known amplification vulnerabilities, which facilitates horizontal comparison. The specific information of the target protocol programs is shown in Table 2. In order to reduce the noise in the fuzz test results, each target is repeated 5 times, and the Tcpdump tool is used to capture all traffic data during the fuzz test. All experiments were conducted on a server equipped with an Intel(R) Core(TM) i7-12700H 2.30GHz processor and 64GB of memory.

[0112] Table 2 Target protocol program and version

[0113]

[0114] a: The program version is represented by a version number or git commit id

[0115] (II) Amplification of vulnerability mining capability assessment

[0116] In order to evaluate AFLAMP's ability to discover amplification vulnerabilities, AFLAMP and AMPFUZZ were used to fuzz test each target for 24 hours and repeated 5 times. Overall, AFLAMP was able to find 11 amplification vulnerabilities in 5 protocol service programs (OpenTFTP, OpenSLP, NTP, Memcached, and Dnsmasq) with known amplification vulnerabilities, including 6 unknown amplification vulnerabilities. Compared with the 8 amplification vulnerabilities found by AMPFUZZ, the vulnerability detection rate increased by 37.5%. In addition, AFLAMP also found 12 amplification vulnerabilities in a TCP-based protocol service program (LightFTP).

[0117] 2.1) Experimental results

[0118] After the fuzz test is completed, the cause of the amplification vulnerability is identified by manually analyzing the amplification vector to find different amplification vulnerability trigger points. These different amplification vulnerability trigger points are regarded as different amplification vulnerabilities. The vulnerability list and causes are shown in Table 3.

[0119] In Table 3, bugid indicates the vulnerability number found in a certain protocol, amps indicates the number of amplification vectors, max(BAF) indicates the maximum bandwidth amplification factor, and max(BAFmsg) indicates the maximum session-based bandwidth amplification factor. At the same time, the maximum value of all five fuzz test results is listed in best, mean indicates the average value of the results, and all state transition-based vulnerabilities are highlighted. Since AMPFUZZ can only find amplification vulnerabilities caused by a single request, its BAF and BAFmsg results are the same, so the BAFmsg value of AMPFUZZ is no longer counted repeatedly.

[0120] The experiment distinguishes different amplification vulnerabilities based on the content of the response message or the operation type of the request message. For example, the #1 and #2 vulnerabilities in LightFTP are mainly distinguished based on the content of the response message. For the LightFTP#1 vulnerability, when the request contains the character Q, the server will parse it as an exit command and then reply with a "Goodbye" response. For the LightFTP#2 vulnerability, when the request contains the string "SY", the server will parse it as a system type query command and then reply with a "UNIX Type: L8" response.

[0121] Table 3 Vulnerability list and causes

[0122]

[0123]

[0124] Note: “-” indicates no related vulnerabilities were found

[0125] At the same time, in order to further compare the amplification vulnerability mining capabilities of AFLAMP and AMPFUZZ, the number of amplification vulnerabilities (bugs), the number of amplification vectors (amps), and the maximum bandwidth amplification factor (maxBAF) mined by the two for each protocol service program were counted. The results are shown in Table 4.

[0126] Table 4 AMPFUZZ and AFLAMP fuzz testing results

[0127]

[0128]

[0129] Note: “-” indicates no related vulnerabilities were found

[0130] From Table 4, we can see that AFLAMP found a total of 23 amplification vulnerabilities in 6 target protocol service programs. Its vulnerability mining ability is generally higher than that of AMPFUZZ. For the same target, AFLAMP can find more amplification vectors with larger amplification factors.

[0131] 2.2) Vulnerability Case Analysis

[0132] SLP (Service Location Protocol) is a network service discovery protocol that allows computers and other devices to find the required network services on a local area network. The recently exposed CVE-2023-29552 vulnerability allows unauthenticated attackers to register any service with the SLP protocol service program. When the attacker then sends a request to the SLP server to obtain the default service, it will cause a traffic amplification attack.

[0133] In the experimental results in Table 3, AFLAMP can discover the same amplification vulnerability OpenSLP#1, while AMPFUZZ cannot. This is mainly because the discovery of this vulnerability requires the registration of services first, thereby increasing the content of the service list, and then requesting the default service list from the server. At this time, the server will return all registered service information. If the service is not registered, a single request to obtain the service list will not be able to discover this amplification vulnerability. The traffic amplification process is as follows: Figure 6 This illustrates the advantage of AFLAMP in discovering state transition-based amplification vulnerabilities.

[0134] Through in-depth analysis of the cause of the amplification vulnerability, it can be found that the length of the service URL and the validity period of the service can be customized when registering the service, so the service can be continuously registered to the server until the maximum cache of the service is reached. After testing, the maximum amplification factor caused by this vulnerability can reach 2235.

[0135] Memcached is a widely used high-performance distributed memory object caching system. According to public reports, attackers can use this protocol service program to launch a nuclear-level ADDoS attack with a maximum amplification factor of up to 50,000, which is also the protocol with the largest amplification factor known so far. The main reason for the Memcached amplification vulnerability is that when the attacker requests the cached data on the server, the server will return the existing cached data without verification, resulting in amplification. In the experimental results, AFLAMP discovered this amplification vulnerability (Memcached#6), while AMPFUZZ failed to discover it. This is mainly due to the fact that AFLAMP uses a state-guided fuzz testing method, which can further explore amplification vulnerabilities based on state transformation.

[0136] In addition, AFLAMP also discovered 5 unknown amplification vulnerabilities, among which the maximum amplification factor of the Memcached#4 vulnerability can reach 128.6, while the maximum amplification factor of the Memcached#4 vulnerability discovered by AMPFUZZ is only 67.52. By analyzing the amplification vectors of the two, such as Figure 7 As shown, we can see that the amplification vector of AMPFUZZ has an additional 8-byte padding, while AFLAMP can find the largest amplification vector by deleting the characters before the delimiter one by one through the seed mutation strategy that maximizes the amplification vector.

[0137] In addition to the above-mentioned UDP-based protocol service programs, AFLAMP has also expanded its support for TCP protocol service programs. In LightFTP, AFLAMP discovered 12 amplification vulnerabilities, among which vulnerabilities LightFTP#8-#12 require login before they can be further triggered. The traffic amplification process is as follows: Figure 8 shown.

[0138] Through the analysis of the experimental results, it can be found that the reasons for the amplification vulnerabilities of many protocols are not unique, that is, the server will amplify the traffic of multiple request types. This further highlights the necessity of using a systematic approach to discover amplification vulnerabilities, because simple defenses that only block fixed request types may be incomplete, and attackers can still use different amplification vectors to launch attacks.

[0139] (III) Ablation experiment

[0140] In order to evaluate whether the state-guided amplification vulnerability mining method can help discover more amplification vulnerabilities, the number of amplification vulnerabilities that AFLAMP can discover when state guidance is enabled and when state guidance is not enabled is compared. The results are shown in Table 5.

[0141] Table 5 AFLAMP ablation experiment results

[0142]

[0143] Note: "AFLAMP w / o SA" means the stateful boot method is not enabled

[0144] According to the experimental results in Table 5, it can be seen that the state-guided method can discover more amplification vulnerabilities, and the overall vulnerability detection rate has increased by 53.33%, indicating that the state-guided amplification vulnerability mining method can help the fuzzer to mine more amplification vulnerabilities. For the TinyDTLS, NTP, and Dnsmasq protocol service programs, the number of amplification vulnerabilities found is the same regardless of whether the state-guided method is enabled. This is mainly because the states of these protocol service programs are relatively simple and are usually not considered to be stateful protocols. For the LightFTP program, since its protocol implementation is more complex and has more protocol states, more amplification vulnerabilities can be found after the state-guided method is enabled.

[0145] The present invention proposes and implements a state-guided protocol service program amplification vulnerability mining framework AFLAMP, which applies the state-guided method to the mining of amplification vulnerabilities, solving the problems of low versatility and limited vulnerability mining capabilities in existing amplification vulnerability mining methods. Experimental results show that the method of the present invention has strong amplification vulnerability mining capabilities.

[0146] Those skilled in the art will appreciate that all or part of the steps in the above method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk or an optical disk. Optionally, all or part of the steps in the above embodiment can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or in the form of software function modules. The present invention is not limited to any specific form of combination of hardware and software.

[0147] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A method for discovering protocol service program amplification vulnerabilities based on state guidance, characterized in that: Include: Use the LLVM compiler to convert the source code into LLVM intermediate instructions, and obtain the termination branch location information of the protocol service program through static analysis; According to the termination branch position information generated by static analysis, the coverage feedback and the program running status perception code are inserted into the program to obtain the protocol service program under test; A fuzz test cycle is performed on the instrumented program, and a seed selection method based on amplification factor feedback is used to select test cases. A seed mutation strategy that maximizes the amplification vector is used to mutate test cases, thereby discovering amplification vulnerabilities in protocol service programs.

2. The state-guided protocol service program amplification vulnerability mining method according to claim 1 is characterized in that: Static analysis includes a semaphore synchronization mechanism based on shared memory to control the interaction process between the fuzzifier and the protocol service program under test. The interaction process is: when the protocol service program is executed, it will first be in a listening state, waiting for a connection from the fuzzifier, and increasing the semaphore in the shared memory; then, after waiting for the semaphore to increase, the fuzzifier will initiate a connection request to the protocol service program under test, and reduce the semaphore in the shared memory; until the fuzzifier receives a response message sent by the protocol service program under test or ends an interaction due to a reception timeout.

3. The state-guided protocol service program amplification vulnerability mining method according to claim 1 is characterized in that: Static analysis also includes terminal branch identification based on taint analysis. The terminal branch identification process is as follows: ① All basic blocks that call Source class functions are regarded as source points, and all basic blocks that call Sink class functions are regarded as sink points; ② Determine which basic blocks can reach the sink point after the source point, and call these basic blocks basic blocks with sink capability. The sink point itself is also regarded as a basic block with sink capability; ③ The edge formed from the basic block with sink capability to the basic block without sink capability is the terminal branch.

4. The state-guided protocol service program amplification vulnerability mining method according to claim 1 is characterized in that: Insert the program running status awareness code into the program including: Traverse each basic block in the protocol service program, obtain the ID information of the last instruction of the basic block, and then traverse all subsequent basic blocks of the basic block, and obtain the ID information of the first instruction of all subsequent basic blocks, compare each edge with the termination branch position information, and when the basic block position where the termination branch is located is found, an instruction calling the terminate function will be inserted after the basic block to complete the stub process.

5. The method for discovering protocol service program amplification vulnerabilities based on state guidance according to claim 1, characterized in that: The amplification factor adopts the session-based bandwidth amplification factor, which is defined as follows: In a fuzz test process, it is assumed that the fuzzer sends m messages to the protocol service program under test, and the size of each message is len (Request payload i ), i represents the i-th request message; the fuzzer receives n messages from the protocol service program under test, and the size of each response message is len(Response payload j ), j represents the jth response message, and its calculation formula is:

6. The state-guided protocol service program amplification vulnerability mining method according to claim 5 is characterized in that: The test case selection using the seed selection method based on amplification factor feedback includes: Traverse all seeds under the selected protocol state, sort the seeds in descending order according to BAFmsg, calculate the ratio of the seed index to the number of seeds under all selected protocol states to get the probability of the seed being selected; select the seed with a larger BAFmsg by setting a lower limit on the probability.

7. The method for discovering protocol service program amplification vulnerabilities based on state guidance according to claim 5, characterized in that: The test case mutation using the seed mutation strategy of maximizing the amplification vector includes: The fuzzer finds a candidate seed with BAFmsg greater than 1 and mutates the seed by deleting bytes one by one from the end of the candidate seed or at the position of the specified delimiter.

8. A protocol service program amplification vulnerability mining system based on state guidance, characterized in that: Contains static analysis module, instrumentation compilation module and fuzz testing module, among which: The static analysis module is used to convert the source code into LLVM intermediate instructions using the LLVM compiler, and obtain the termination branch location information of the protocol service program through static analysis; The stub compilation module is used to insert coverage feedback and program running status perception code into the program according to the termination branch location information generated by static analysis to obtain the protocol service program under test; The fuzz testing module is used to perform fuzz testing cycles on the instrumented program, select test cases using a seed selection method based on amplification factor feedback, and mutate test cases using a seed mutation strategy that maximizes the amplification vector, thereby exploring amplification vulnerabilities in protocol service programs.

Images