Automatic detection method of software upgrade vulnerability based on network traffic analysis

Jinhui TENG; Yan GUANG; Hui SHU; Bing ZHANG

doi:10.11959/j.issn.2096-109x.2020004

您当前的位置：

首页 >

文章列表页 >

Automatic detection method of software upgrade vulnerability based on network traffic analysis

Papers | 更新时间：2024-06-03

- Automatic detection method of software upgrade vulnerability based on network traffic analysis
- Chinese Journal of Network and Information Security Vol. 6, Issue 1, Pages: 94-108(2020)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2020004
  CLC： TP309.5
- Online First：2020-02，
  
  Published：15 February 2020
- 稿件说明：
移动端阅览
Jinhui TENG, Yan GUANG, Hui SHU, et al. Automatic detection method of software upgrade vulnerability based on network traffic analysis[J]. Chinese Journal of Network and Information Security, 2020, 6(1): 94-108.
DOI：

Jinhui TENG, Yan GUANG, Hui SHU, et al. Automatic detection method of software upgrade vulnerability based on network traffic analysis[J]. Chinese Journal of Network and Information Security, 2020, 6(1): 94-108. DOI： 10.11959/j.issn.2096-109x.2020004.

摘要

软件升级过程中，缺乏对升级信息或升级包的认证可能会导致基于中间人攻击的远程代码执行漏洞。为此，提出一种升级漏洞自动检测方法。该方法通过提取升级过程中的网络流量，对升级机制自动画像，将其与漏洞特征向量匹配，预判升级漏洞；在模拟验证环境中，利用画像信息实施中间人攻击，验证检测结果。基于该方法设计了升级漏洞自动分析与验证系统，对 184 个 Windows 应用软件样本进行测试，检测出 117个样本的升级漏洞，证明了本方法的有效性。

Abstract

During the software upgrade process

the lack of authentication for upgrade information or packages can lead to remote code execution vulnerabilities based on man-in-the-middle attack.An automatic detection method for upgrading vulnerabilities was proposed.The method described the upgrade mechanism by extracting the network traffic during the upgrade process

then matched it with the vulnerability feature vector to anticipate upgrading vulnerabilities.In a validation environment

the man-in-the-middle attack using the portrait information was carried out to verify the detection results.In addition

an automatic vulnerability analysis and verification system based on this method was designed.184 Windows applications samples was test and 117 upgrade vulnerabilities were detected in these samples

which proved validity of the method.

关键词

Keywords

references

张海藩 . 软件工程导论 [M ] . 北京 : 清华大学出版社 , 1998 .

ZHANG H F . Introduction to software engineering [M ] . Beijing : Tsinghua University PressPress , 1998 .

彭先觉 , 胡勇 . 利用软件在线升级的攻击 [J ] . 通信技术 , 2015 ( 10 ): 1183 - 1186 .

PENG X J , HU Y . Attacks using online software upgrade [J ] . Communications Technology , 2015 ( 10 ): 1183 - 1186 .

傅建明 , 刘高 , 李鹏伟 . 一种杀毒软件升级流程的安全性分析方法 [J ] . 武汉大学学报(理学版) , 2015 ( 6 ): 509 - 516 .

FU J M , LIU G , LI P W . A security analysis method of antivirus software upgrade process [J ] . Journal of Wuhan University (Natrual Science Edition) , 2015 ( 6 ): 509 - 516 .

周振飞 . 软件供应链污染机理与防御研究 [D ] . 北京:北京邮电大学 , 2018 .

ZHOU Z F . Research on software supply chain pollution mechanism and defense [D ] . Beijing:Beijing University of Posts and Telecommunications , 2018 .

CATUOGNO L , GALDI C , PERSIANO G . Guaranteeing dependency enforcement in software updates [M ] . Secure IT Systems . Springer International Publishing , 2015 .

赵作鹏 , 尹志民 , 王潜平 , 等 . 一种改进的编辑距离算法及其在数据处理中的应用 [J ] . 计算机应用 , 2009 , 29 ( 2 ): 424 - 426 .

ZHAO Z P , YIN Z M , WANG Q P , et al . An improved edit distance algorithm and its application in data processing [J ] . Journal of Computer Applications , 2009 , 29 ( 2 ): 424 - 426 .

刘倩 . 基于 Kali Linux 的网络安全技术探讨与研究 [D ] . 长春:吉林大学 , 2018 .

LIU Q . Discussion and research on network security technology based on Kali Linux [D ] . Changchun:Jilin University , 2018 .

王乾 . 基于动态二进制分析的关键函数定位技术研究 [D ] . 郑州:信息工程大学 , 2012 .

WANG Q . Research on key function location technology based on dynamic binary analysis [D ] . Zhengzhou:Information Engineering University , 2012 .

Views

443

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Research progress on detection of software vulnerabilities based on code similarity

Deep learning vulnerability detection method based on optimized inter-procedural semantics of programs

Hardcoded vulnerability detection approach for IoT device firmware

Intelligent vulnerability detection system based on graph structured source code slice

Code vulnerability detection method based on graph neural network

Related Author

DONG Weiyu

TANG Yonghe

LIU Chunling

LI Qinghao

Hai JIN

Deqing ZOU

Zhen LI

Weizhong QIANG

Related Institution

Information Engineering University

Services Computing Technology and System Lab, National Engineering Research Center for Big Data Technology

Hubei Key Laboratory of Distributed System Security

School of Cyber Science and Engineering, Huazhong University of Science and Technology

School of Computer Science and Engineering, Huazhong University of Science and Technology

⁰