Amplification vulnerability mining method based on state-guided

JIANG Sikang; CAI Ruijie; YIN Xiaokang; CHEN Hongyu; LIU Shengli

doi:10.11959/j.issn.2096-109x.2025012

您当前的位置：

首页 >

文章列表页 >

Amplification vulnerability mining method based on state-guided

Papers | 更新时间：2025-03-20

- Amplification vulnerability mining method based on state-guided
- Chinese Journal of Network and Information Security Vol. 11, Issue 1, Pages: 165-177(2025)
- 作者机构：
  
  信息工程大学，河南郑州 450001
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2025012
  CLC： TP393
- Received：13 July 2024，
  
  Revised：2024-11-24，
  
  Published：25 February 2025
- 稿件说明：
移动端阅览
蒋思康, 蔡瑞杰, 尹小康, 等. 基于状态引导的放大漏洞挖掘方法[J]. 网络与信息安全学报, 2025, 11(1): 165-177.

JIANG S K, CAI R J, YIN X K, et al. Amplification vulnerability mining method based on state-guided[J]. Chinese Journal of Network and Information Security, 2025, 11(1): 165-177.
蒋思康, 蔡瑞杰, 尹小康, 等. 基于状态引导的放大漏洞挖掘方法[J]. 网络与信息安全学报, 2025, 11(1): 165-177. DOI： 10.11959/j.issn.2096-109x.2025012.

JIANG S K, CAI R J, YIN X K, et al. Amplification vulnerability mining method based on state-guided[J]. Chinese Journal of Network and Information Security, 2025, 11(1): 165-177. DOI： 10.11959/j.issn.2096-109x.2025012.

摘要

基于放大的分布式拒绝服务（amplification-based distributed denial of service

ADDoS）攻击对互联网是严重威胁。近年来，ADDoS攻击事件显示该类攻击流量巨大且所利用的协议类型多样，其中放大漏洞是导致ADDoS攻击的主要原因之一。然而，迄今已知的放大漏洞主要是研究人员通过经验知识发现或者通过分析放大攻击事件的流量发现的，缺乏主动挖掘放大漏洞的方法。已有的放大漏洞挖掘方法AmpFuzz，仅考虑单个请求的放大攻击模式，并且局限于UDP，适用性不强。为此，提出基于状态引导的放大漏洞挖掘方法AFLAMP，通过协议状态引导模糊测试，并采用基于会话的带宽放大系数指导种子选择，以更有效地挖掘放大漏洞。实验结果表明，该方法可有效挖掘放大漏洞，并在5个已知存在放大漏洞的协议服务程序（OpenTFTP、OpenSLP、NTP、Memcached、Dnsmasq）中发现了11个放大漏洞，其中包括6个未知的放大漏洞，相较于AmpFuzz，漏洞检出率提高37.5%。此外，AFLAMP还在基于TCP的协议服务程序（LightFTP）中发现了12个放大漏洞。

Abstract

Amplification-based distributed denial of service (ADDoS) attacks have posed a persistent and severe threat to the Internet. Recent incidents revealed that these attacks not only generated substantial traffic but also exploited a diverse range of protocol types

with amplification vulnerabilities being identified as a primary cause. Traditionally

known amplification vulnerabilities were discovered either through empirical knowledge or by analyzing traffic from amplification attack incidents

highlighting a lack of proactive methods for identifying such vulnerabilities. Existing approaches

such as AmpFuzz

were limited to focusing solely on amplification patterns for individual requests and were restricted to the UDP protocol

which constrained their applicability. To address these limitations

a state-guided method for mining amplification vulnerabilities

referred to as AFLAMP

was proposed. This method leveraged protocol state to guide fuzz testing and employed session-based bandwidth amplification coefficients for seed selection

thereby enhancing the effectiveness of vulnerability discovery. Experimental results demonstrate that AFLAMP successfully identifies amplification vulnerabilities

uncovering 11 vulnerabilities in five services known to be susceptible (OpenTFTP

OpenSLP

NTP

Memcached

and Dnsmasq)

including six previously unknown vulnerabilities. Compared to AmpFuzz

AFLAMP achieves 37.5% increase in the detection rate of vulnerabilities. Additionally

AFLAMP identifies 12 amplification vulnerabilities in a TCP-based service program (LightFTP).

关键词

Keywords

references

ISMAIL S , HASSEN H R , JUST M , et al . A review of amplifica-tion-based distributed denial of service attacks and their mitiga-tion [J ] . Computers & Security , 2021 , 109 : 102380 .

KRUPP J , GRISHCHENKO I , ROSSOW C . AmpFuzz: fuzzing for amplification DDoS vulnerabilities [C ] // /Proceedings of the 31th USENIX Security Symposium (USENIX Security 2022), Berkeley : USENIX Association , 2022 : 1043 - 1060 .

ROSSOW C . Amplification hell: revisiting network protocols for DDoS abuse [C ] // Proceedings of the 21st Annual Network and Distributed System Security Symposium(NDSS 2014) . Virginia : the Internet Society , 2014 : 1 - 15 .

CZYZ J , KALLITSIS M , GHARAIBEH M , et al . Taming the 800 pound gorilla: the rise and decline of NTP DDoS attacks [C ] // Proceedings of the 2014 Conference on Internet Measurement Conference . New York : ACM Press , 2014 : 435 - 448 .

RIJSWIJK-DEIJ R V , SPEROTTO A , PRAS A . DNSSEC and its potential for DDoS attacks: a comprehensive measurement study [C ] // Proceedings of the 2014 Conference on Internet Measurement Conference . New York : ACM Press , 2014 : 449 - 460 .

ADAMSKY F , KHAYAM S A , JAGER R , et al . P2P file-sharing in hell: exploiting BitTorrent vulnerabilities to launch distributed reflective DoS attacks [C ] // Proceedings of the 9th USENIX Workshop on Offensive Technologies (WOOT 15) . Berkeley : USENIX Association , 2015 .

XU W , LI X , LU C , et al . TsuKing: coordinating DNS resolvers and queries into potent DoS amplifiers [C ] // Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM Press , 2023 : 311 - 325 .

KÜHRER M , HUPPERICH T , ROSSOW C , et al . Hell of a handshake: abusing TCP for reflective amplification DDoS attacks [C ] // Proceedings of the 8th USENIX Workshop on Offensive Technologies (WOOT 14) . Berkeley : USENIX Association , 2014 .

BOCK K , ALARAJ A , FAX Y , et al . Weaponizing middleboxes for TCP reflected amplification [C ] // Proceedings of the 30th USENIX Security Symposium (USENIX Security 21) . Berkeley : USENIX Association , 2021 : 3345 - 3361 .

PHAM V T , BOHME M , ROYCHOUDHURY A . AFLNET: a greybox fuzzer for network protocols [C ] // Proceedings of the 2020 IEEE 13th International Conference on Software Testing, Validation and Verification (ICST) . Piscataway : IEEE Press , 2020 : 460 - 465 .

NATELLA R . Stateafl: greybox fuzzing for stateful network servers [J ] . Empirical Software Engineering , 2022 , 27 ( 7 ): 191 .

LIU D , PHAM V T , ERNST G , et al . State selection algorithms and their impact on the performance of stateful network protocol fuzzing [C ] // Proceedings of the 2022 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER) . Piscataway : IEEE Press , 2022 : 720 - 730 .

ANDRONIDIS A , CADAR C . SnapFuzz: high-throughput fuzzing of network applications [C ] // Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis . New York : ACM Press , 2022 : 340 - 351 .

QIN S , HU F , MA Z , et al . NSFuzz: towards efficient and state-aware network service fuzzing [J ] . ACM Transactions on Software Engineering and Methodology , 2023 , 32 ( 6 ): 1 - 26 .

NATELLA R , PHAM V T . Profuzzbench: a benchmark for stateful protocol fuzzing [C ] // Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis . New York : ACM Press , 2021 : 662 - 665 .

KLEES G , RUEF A , COOPER B , et al . Evaluating fuzz testing [C ] // Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM Press , 2018 : 2123 - 2138 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

NXNSAttack traffic detection method based on spatio-temporal feature fusion deep learning

IKEChecker: grammar-guided stateful fuzzer for IKE protocol implementions

Automated vulnerability discovery method for 5G core network protocol

Related Author

LIU Yuxiang

MO Xiuliang

GONG Liangyi

LYU Kunxian

ZUO Peng

ZHENG Yonghui

ZHAO Dongliang

GU Chunxiang

Related Institution

School of Computer Science and Engineering, Tianjin University of Technology

Computer Network Information Center, Chinese Academy of Sciences

University of Chinese Academy of Sciences

China Internet Network Information Center

⁰