基于重放分析的网络协议软件状态变量自动化发现技术

黄见欣; 喻波; 刘润昊; 苏金树

doi:10.1631/FITEE.2200275

Your Location：

Home >

Browse articles >

基于重放分析的网络协议软件状态变量自动化发现技术

常规文章 | Updated：2023-03-24

- 基于重放分析的网络协议软件状态变量自动化发现技术
- Automatic discovery of stateful variables in network protocol software based on replay analysis
- 信息与电子工程前沿（英文） 2023年24卷第3期页码：403-416
- Affiliations：
  
  1.College of Computer Science and Technology, National University of Defense Technology, Changsha 410073, China
  2.Academy of Military Science, Beijing 100091, China
- Author bio：
  
  E-mail: jxin8585@nudt.edu.cn
  ‡ Corresponding authors
  runhaoliu@nudt.edu.cn
- Funds：
  
  National Natural Science Foundation of China(61902416;61902412);Natural Science Foundation of Hunan Province, China(2019JJ50729)
- DOI：10.1631/FITEE.2200275
  中图分类号： TP311
- 收稿：2022-06-25，
  
  录用：2022-11-09，
  
  纸质出版：2023-03-0
- Accepted：
Scan QR Code
黄见欣, 喻波, 刘润昊, 等. 基于重放分析的网络协议软件状态变量自动化发现技术[J]. 信息与电子工程前沿（英文）, 2023,24(3):403-416.

Jianxin HUANG, Bo YU, Runhao LIU, et al. Automatic discovery of stateful variables in network protocol software based on replay analysis[J]. Frontiers of Information Technology & Electronic Engineering, 2023, 24(3): 403-416.
黄见欣, 喻波, 刘润昊, 等. 基于重放分析的网络协议软件状态变量自动化发现技术[J]. 信息与电子工程前沿（英文）, 2023,24(3):403-416. DOI： 10.1631/FITEE.2200275.

Jianxin HUANG, Bo YU, Runhao LIU, et al. Automatic discovery of stateful variables in network protocol software based on replay analysis[J]. Frontiers of Information Technology & Electronic Engineering, 2023, 24(3): 403-416. DOI： 10.1631/FITEE.2200275.

摘要

网络协议软件通常具有程序路径复杂、状态空间庞大的特点。程序中往往存在着一些带有状态的关键变量，用于记录协议状态和会话信息。这些状态变量一旦处理不当，很可能违背协议规范，进而产生逻辑错误，导致协议软件出现潜在的缺陷或漏洞。本文针对现有程序分析技术难以发现网络协议软件中的状态变量，且自动化程度偏低的问题，提出一种基于重放分析的状态变量识别方法。考虑到状态变量主要反映着通信双方的参数和程序的状态，具有这些特征的变量通常会以全局变量或静态变量的形式，持续存在于进程之中，该方法通过记录和重放协议软件的执行轨迹，运用动态插桩技术，在协议状态和软件状态的变化过程中，分析内存关键区域的全局变量和静态变量的状态特征，并结合规则进行筛选判定。在此基础上，设计并实现了一套能够自动化发现状态变量的原型系统，在ProFuzzBench中的9个程序和2个现实中的复杂协议软件上进行了测试。实验结果显示，平均真正类率（TPR）可达82%，平均准确度可达96%左右。

Abstract

Network protocol software is usually characterized by complicated functions and a vast state space. In this type of program

a massive number of stateful variables that are used to represent the evolution of the states and store some information about the sessions are prone to potential flaws caused by violations of protocol specification requirements and program logic. Discovering such variables is significant in discovering and exploiting vulnerabilities in protocol software

and still needs massive manual verifications. In this paper

we propose a novel method that could automatically discover the use of stateful variables in network protocol software. The core idea is that a stateful variable features information of the communication entities and the software states

so it will exist in the form of a global or static variable during program execution. Based on recording and replaying a protocol program's execution

varieties of variables in the life cycle can be tracked with the technique of dynamic instrument. We draw up some rules from multiple dimensions by taking full advantage of the existing vulnerability knowledge to determine whether the data stored in critical memory areas have stateful characteristics. We also implement a prototype system that can discover stateful variables automatically and then perform it on nine programs in ProFuzzBench and two complex real-world software programs. With the help of available open-source code

the evaluation results show that the average true positive rate (TPR) can reach 82% and the average precision can be approximately up to 96%.

关键词

Keywords

references

Aviram A , Weng SC , Hu S , et al. , 2012 . Efficient system-enforced deterministic parallelism . Commun ACM , 55 ( 5 ): 111 - 119 . doi: 10.1145/2160718.2160742 http://doi.org/10.1145/2160718.2160742

Bergan T , Hunt N , Ceze L , et al. , 2010 . Deterministic process groups in DoS . Proc 9 th USENIX Symp on Operating Systems Design and Implementation , p. 177 - 191 .

Bruening D , Zhao Q , 2011 . Practical memory checking with Dr.Memory . Proc Int Symp on Code Generation and Optimization , p. 213 - 223 . doi: 10.1109/CGO.2011.5764689 http://doi.org/10.1109/CGO.2011.5764689

Brumley D , Caballero J , Liang ZK , et al. , 2007 . Towards automatic discovery of deviations in binary implementations with applications to error detection and fingerprint generation . Proc 16 th USENIX Security Symp , p. 213 - 228 .

Dolan-Gavitt B , Hodosh J , Hulin P , et al. , 2015 . Repeatable reverse engineering with PANDA . Proc 5 th Program Protection and Reverse Engineering Workshop , Article 4 . doi: 10.1145/2843859.2843867 http://doi.org/10.1145/2843859.2843867

Dunlap GW , King ST , Cinar S , et al. , 2002 . ReVirt: enabling intrusion analysis through virtual-machine logging and replay . ACM SIGOPS Oper Syst Rev , 36 ( SI ): 211 - 224 . doi: 10.1145/844128.844148 http://doi.org/10.1145/844128.844148

Dunlap GW , Lucchetti DG , Fetterman MA , et al. , 2008 . Execution replay of multiprocessor virtual machines . Proc 4 th ACM SIGPLAN/SIGOPS Int Conf on Virtual Execution Environments , p. 121 - 130 . doi: 10.1145/1346256.1346273 http://doi.org/10.1145/1346256.1346273

Fioraldi A , D'Elia DC , Balzarotti D , 2021 . The use of likely invariants as feedback for fuzzers . Proc 30 th USENIX Security Symp , p. 2829 - 2846 .

Garmany B , Stoffel M , Gawlik R , et al. , 2019 . Static detection of uninitialized stack variables in binary code . Proc 24 th European Symp on Research in Computer Security , p. 68 - 87 . doi: 10.1007/978-3-030-29962-0_4 http://doi.org/10.1007/978-3-030-29962-0_4

Giuffrida C , Cavallaro L , Tanenbaum AS , 2013 . Practical automated vulnerability monitoring using program state invariants . Proc 43 rd Annual IEEE/IFIP Int Conf on Dependable Systems and Networks , p. 1 - 12 . doi: 10.1109/DSN.2013.6575318 http://doi.org/10.1109/DSN.2013.6575318

Hower DR , Hill MD , 2008 . Rerun: exploiting episodes for lightweight memory race recording . Proc Int Symp on Computer Architecture , p. 265 - 276 . doi: 10.1109/ISCA.2008.26 http://doi.org/10.1109/ISCA.2008.26

Lee C , Bae J , Lee H , 2018 . PRETT: protocol reverse engineering using binary tokens and network traces . Proc 33 rd IFIP Int Conf on ICT Systems Security and Privacy Protection , p. 141 - 155 . doi: 10.1007/978-3-319-99828-2_11 http://doi.org/10.1007/978-3-319-99828-2_11

Li JQ , Li SY , Sun G , et al. , 2022 . SNPSFuzzer: a fast greybox fuzzer for stateful network protocols using snapshots . IEEE Trans Inform Forens Secur , 17 : 2673 - 2687 . doi: 10.1109/TIFS.2022.3192991 http://doi.org/10.1109/TIFS.2022.3192991

Milburn A , Bos H , Giuffrida C , 2017 . Safelnit: comprehensive and practical mitigation of uninitialized read vulnerabilities . Proc 24 th Annual Network and Distributed System Security Symp . doi: 10.14722/ndss.2017.23183 http://doi.org/10.14722/ndss.2017.23183

Montesinos P , Ceze L , Torrellas J , 2008 . DeLorean: recording and deterministically replaying shared-memory multiprocessor execution efficiently . ACM SIGARCH Comput Archit News , 36 ( 3 ): 289 - 300 . doi: 10.1145/1394608.1382146 http://doi.org/10.1145/1394608.1382146

Musuvathi M , Engler DR , 2004 . Model checking large network protocol implementations . Proc 1 st Conf on Symp on Networked Systems Design and Implementation , p. 1 - 12 .

Natella R , 2022 . StateAFL: greybox fuzzing for stateful network servers . Empir Softw Eng , 27 ( 7 ): 191 . doi: 10.1007/s10664-022-10233-3 http://doi.org/10.1007/s10664-022-10233-3

O'Callahan R , Jones C , Froyd N , et al. , 2017 . Engineering record and replay for deployability . Proc USENIX Conf on Usenix Annual Technical Conf , p. 377 - 389 .

Pham V , Böhme M , Roychoudhury A , 2020 . AFLNET: a greybox fuzzer for network protocols . Proc 13 th Int Conf on Software Testing, Validation and Verification , p. 460 - 465 . doi: 10.1109/ICST46399.2020.00062 http://doi.org/10.1109/ICST46399.2020.00062

Pokam G , Danne K , Pereira C , et al. , 2013 . QuickRec: prototyping an Intel architecture extension for record and replay of multithreaded programs . ACM SIGARCH Comput Archit News , 41 ( 3 ): 643 - 654 . doi: 10.1145/2508148.2485977 http://doi.org/10.1145/2508148.2485977

Saito Y , 2005 . Jockey: a user-space library for record-replay debugging . Proc 6 th Int Symp on Automated Analysis-Driven Debugging , p. 69 - 76 . doi: 10.1145/1085130.1085139 http://doi.org/10.1145/1085130.1085139

Song CX , Yu B , Zhou X , et al. , 2019 . SPFuzz: a hierarchical scheduling framework for stateful network protocol fuzzing . IEEE Access , 7 : 18490 - 18499 . doi: 10.1109/ACCESS.2019.2895025 http://doi.org/10.1109/ACCESS.2019.2895025

Stepanov E , Serebryany K , 2015 . MemorySanitizer: fast detector of uninitialized memory use in C++ . Proc IEEE/ACM Int Symp on Code Generation and Optimization , p. 46 - 55 . doi: 10.1109/CGO.2015.7054186 http://doi.org/10.1109/CGO.2015.7054186

Ye D , Sui YL , Xue JL , 2014 . Accelerating dynamic detection of uses of undefined values with static value-flow analysis . Proc Annual IEEE/ACM Int Symp on Code Generation and Optimization , p. 154 - 164 . doi: 10.1145/2544137.2544154 http://doi.org/10.1145/2544137.2544154

Yu B , Wang PF , Yue T , et al. , 2019 . Poster: fuzzing IoT firmware via multi-stage message generation . Proc ACM SIGSAC Conf on Computer and Communications Security , p. 2525 - 2527 . doi: 10.1145/3319535.3363247 http://doi.org/10.1145/3319535.3363247

浏览量

177

Downloads

CSCD

文章被引用时，请邮件提醒。

Submit

工具集

关联资源

EdgeKeeper: a trusted edge computing framework for ubiquitous power Internet of Things

Game theoretic analysis for the mechanism of moving target defense

A keyed-hashing based self-synchronization mechanism for port address hopping communication

Anonymous-address-resolution model

Botnet detection techniques: review, future trends, and issues