网络协议安全对于互联网信息安全至关重要。目前主流的网络协议漏洞挖掘技术在安全性能、数据完整性、协议解析和逆向漏洞挖掘等方面还存在缺陷。模糊测试因其自动化程度高且能直接获得漏洞概念验证(Proof of Concept,PoC)的特点,在协...网络协议安全对于互联网信息安全至关重要。目前主流的网络协议漏洞挖掘技术在安全性能、数据完整性、协议解析和逆向漏洞挖掘等方面还存在缺陷。模糊测试因其自动化程度高且能直接获得漏洞概念验证(Proof of Concept,PoC)的特点,在协议安全测试中被广泛使用。然而,针对闭源协议的模糊测试,目前还缺少成熟的解决方案。因此,提出了NASFuzz模糊测试框架,能够对闭源NAS协议(NFS、NAS Find协议)进行漏洞挖掘。首先对闭源协议通信字段进行逆向,形成语法语义合规的模板;其次基于该模板,针对性变异字段中的非保留字段进行变异,生成大量的测试字段对协议进行测试。实验显示,NASFuzz模糊测试框架相比黑盒模糊测试框架BooFuzz,其有效样例生成数量高出70%以上,代码覆盖率提升18%,证明NASFuzz对NAS协议的测试相比传统黑盒测试更充分。展开更多
With the increasing explosively of data in network,more and more people pay attention to the networked storage ,currently the main technology of networked storage is NAS ( Network Attached Storage )and SAN ( Storage A...With the increasing explosively of data in network,more and more people pay attention to the networked storage ,currently the main technology of networked storage is NAS ( Network Attached Storage )and SAN ( Storage Area Network ). They are different ,and they are not competed but complement ,they are used in different occasion.To reduce the TOC (total of cost),people hope to merges the two technology :design a united storage network,it can supply the virtues and overcome the drawbacks of the NAS and SAN. This paper analysis and discuss the topic.展开更多
文摘网络协议安全对于互联网信息安全至关重要。目前主流的网络协议漏洞挖掘技术在安全性能、数据完整性、协议解析和逆向漏洞挖掘等方面还存在缺陷。模糊测试因其自动化程度高且能直接获得漏洞概念验证(Proof of Concept,PoC)的特点,在协议安全测试中被广泛使用。然而,针对闭源协议的模糊测试,目前还缺少成熟的解决方案。因此,提出了NASFuzz模糊测试框架,能够对闭源NAS协议(NFS、NAS Find协议)进行漏洞挖掘。首先对闭源协议通信字段进行逆向,形成语法语义合规的模板;其次基于该模板,针对性变异字段中的非保留字段进行变异,生成大量的测试字段对协议进行测试。实验显示,NASFuzz模糊测试框架相比黑盒模糊测试框架BooFuzz,其有效样例生成数量高出70%以上,代码覆盖率提升18%,证明NASFuzz对NAS协议的测试相比传统黑盒测试更充分。
文摘With the increasing explosively of data in network,more and more people pay attention to the networked storage ,currently the main technology of networked storage is NAS ( Network Attached Storage )and SAN ( Storage Area Network ). They are different ,and they are not competed but complement ,they are used in different occasion.To reduce the TOC (total of cost),people hope to merges the two technology :design a united storage network,it can supply the virtues and overcome the drawbacks of the NAS and SAN. This paper analysis and discuss the topic.
