基于状态引导的放大漏洞挖掘方法

蒋思康; 蔡瑞杰; 尹小康; 陈鸿羽; 刘胜利

doi:10.11959/j.issn.2096-109x.2025012

您当前的位置：

首页 >

文章列表页 >

基于状态引导的放大漏洞挖掘方法

学术论文 | 更新时间：2025-03-20

- 基于状态引导的放大漏洞挖掘方法
- Amplification vulnerability mining method based on state-guided
- 网络与信息安全学报 2025年11卷第1期页码：165-177
- 作者机构：
  
  信息工程大学，河南郑州 450001
- 作者简介：
  
  [ "蒋思康（1997- ），男，浙江义乌人，信息工程大学硕士生，主要研究方向为模糊测试与漏洞挖掘。" ]
  [ "蔡瑞杰（1990- ），男，河南开封人，信息工程大学讲师，主要研究方向为网络安全。" ]
  [ "尹小康（1993- ），男，河南周口人，信息工程大学讲师，主要研究方向为网络安全、二进制代码分析和机器学习。" ]
  [ "陈鸿羽（2001- ），男，辽宁辽中人，信息工程大学博士生，主要研究方向为模糊测试与漏洞挖掘。" ]
  [ "刘胜利（1973- ），男，河南周口人，信息工程大学教授、博士生导师，主要研究方向为网络设备安全和网络攻击检测。" ]
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2025012
  中图分类号： TP393
- 收稿：2024-07-13，
  
  修回：2024-11-24，
  
  纸质出版：2025-02-25
- 稿件说明：
移动端阅览
蒋思康, 蔡瑞杰, 尹小康, 等. 基于状态引导的放大漏洞挖掘方法[J]. 网络与信息安全学报, 2025, 11(1): 165-177.

JIANG S K, CAI R J, YIN X K, et al. Amplification vulnerability mining method based on state-guided[J]. Chinese Journal of Network and Information Security, 2025, 11(1): 165-177.
蒋思康, 蔡瑞杰, 尹小康, 等. 基于状态引导的放大漏洞挖掘方法[J]. 网络与信息安全学报, 2025, 11(1): 165-177. DOI： 10.11959/j.issn.2096-109x.2025012.

JIANG S K, CAI R J, YIN X K, et al. Amplification vulnerability mining method based on state-guided[J]. Chinese Journal of Network and Information Security, 2025, 11(1): 165-177. DOI： 10.11959/j.issn.2096-109x.2025012.

摘要

基于放大的分布式拒绝服务（amplification-based distributed denial of service

ADDoS）攻击对互联网是严重威胁。近年来，ADDoS攻击事件显示该类攻击流量巨大且所利用的协议类型多样，其中放大漏洞是导致ADDoS攻击的主要原因之一。然而，迄今已知的放大漏洞主要是研究人员通过经验知识发现或者通过分析放大攻击事件的流量发现的，缺乏主动挖掘放大漏洞的方法。已有的放大漏洞挖掘方法AmpFuzz，仅考虑单个请求的放大攻击模式，并且局限于UDP，适用性不强。为此，提出基于状态引导的放大漏洞挖掘方法AFLAMP，通过协议状态引导模糊测试，并采用基于会话的带宽放大系数指导种子选择，以更有效地挖掘放大漏洞。实验结果表明，该方法可有效挖掘放大漏洞，并在5个已知存在放大漏洞的协议服务程序（OpenTFTP、OpenSLP、NTP、Memcached、Dnsmasq）中发现了11个放大漏洞，其中包括6个未知的放大漏洞，相较于AmpFuzz，漏洞检出率提高37.5%。此外，AFLAMP还在基于TCP的协议服务程序（LightFTP）中发现了12个放大漏洞。

Abstract

Amplification-based distributed denial of service (ADDoS) attacks have posed a persistent and severe threat to the Internet. Recent incidents revealed that these attacks not only generated substantial traffic but also exploited a diverse range of protocol types

with amplification vulnerabilities being identified as a primary cause. Traditionally

known amplification vulnerabilities were discovered either through empirical knowledge or by analyzing traffic from amplification attack incidents

highlighting a lack of proactive methods for identifying such vulnerabilities. Existing approaches

such as AmpFuzz

were limited to focusing solely on amplification patterns for individual requests and were restricted to the UDP protocol

which constrained their applicability. To address these limitations

a state-guided method for mining amplification vulnerabilities

referred to as AFLAMP

was proposed. This method leveraged protocol state to guide fuzz testing and employed session-based bandwidth amplification coefficients for seed selection

thereby enhancing the effectiveness of vulnerability discovery. Experimental results demonstrate that AFLAMP successfully identifies amplification vulnerabilities

uncovering 11 vulnerabilities in five services known to be susceptible (OpenTFTP

OpenSLP

NTP

Memcached

and Dnsmasq)

including six previously unknown vulnerabilities. Compared to AmpFuzz

AFLAMP achieves 37.5% increase in the detection rate of vulnerabilities. Additionally

AFLAMP identifies 12 amplification vulnerabilities in a TCP-based service program (LightFTP).

关键词

Keywords

references

ISMAIL S , HASSEN H R , JUST M , et al . A review of amplifica-tion-based distributed denial of service attacks and their mitiga-tion [J ] . Computers & Security , 2021 , 109 : 102380 .

KRUPP J , GRISHCHENKO I , ROSSOW C . AmpFuzz: fuzzing for amplification DDoS vulnerabilities [C ] // /Proceedings of the 31th USENIX Security Symposium (USENIX Security 2022), Berkeley : USENIX Association , 2022 : 1043 - 1060 .

ROSSOW C . Amplification hell: revisiting network protocols for DDoS abuse [C ] // Proceedings of the 21st Annual Network and Distributed System Security Symposium(NDSS 2014) . Virginia : the Internet Society , 2014 : 1 - 15 .

CZYZ J , KALLITSIS M , GHARAIBEH M , et al . Taming the 800 pound gorilla: the rise and decline of NTP DDoS attacks [C ] // Proceedings of the 2014 Conference on Internet Measurement Conference . New York : ACM Press , 2014 : 435 - 448 .

RIJSWIJK-DEIJ R V , SPEROTTO A , PRAS A . DNSSEC and its potential for DDoS attacks: a comprehensive measurement study [C ] // Proceedings of the 2014 Conference on Internet Measurement Conference . New York : ACM Press , 2014 : 449 - 460 .

ADAMSKY F , KHAYAM S A , JAGER R , et al . P2P file-sharing in hell: exploiting BitTorrent vulnerabilities to launch distributed reflective DoS attacks [C ] // Proceedings of the 9th USENIX Workshop on Offensive Technologies (WOOT 15) . Berkeley : USENIX Association , 2015 .

XU W , LI X , LU C , et al . TsuKing: coordinating DNS resolvers and queries into potent DoS amplifiers [C ] // Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM Press , 2023 : 311 - 325 .

KÜHRER M , HUPPERICH T , ROSSOW C , et al . Hell of a handshake: abusing TCP for reflective amplification DDoS attacks [C ] // Proceedings of the 8th USENIX Workshop on Offensive Technologies (WOOT 14) . Berkeley : USENIX Association , 2014 .

BOCK K , ALARAJ A , FAX Y , et al . Weaponizing middleboxes for TCP reflected amplification [C ] // Proceedings of the 30th USENIX Security Symposium (USENIX Security 21) . Berkeley : USENIX Association , 2021 : 3345 - 3361 .

PHAM V T , BOHME M , ROYCHOUDHURY A . AFLNET: a greybox fuzzer for network protocols [C ] // Proceedings of the 2020 IEEE 13th International Conference on Software Testing, Validation and Verification (ICST) . Piscataway : IEEE Press , 2020 : 460 - 465 .

NATELLA R . Stateafl: greybox fuzzing for stateful network servers [J ] . Empirical Software Engineering , 2022 , 27 ( 7 ): 191 .

LIU D , PHAM V T , ERNST G , et al . State selection algorithms and their impact on the performance of stateful network protocol fuzzing [C ] // Proceedings of the 2022 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER) . Piscataway : IEEE Press , 2022 : 720 - 730 .

ANDRONIDIS A , CADAR C . SnapFuzz: high-throughput fuzzing of network applications [C ] // Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis . New York : ACM Press , 2022 : 340 - 351 .

QIN S , HU F , MA Z , et al . NSFuzz: towards efficient and state-aware network service fuzzing [J ] . ACM Transactions on Software Engineering and Methodology , 2023 , 32 ( 6 ): 1 - 26 .

NATELLA R , PHAM V T . Profuzzbench: a benchmark for stateful protocol fuzzing [C ] // Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis . New York : ACM Press , 2021 : 662 - 665 .

KLEES G , RUEF A , COOPER B , et al . Evaluating fuzz testing [C ] // Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM Press , 2018 : 2123 - 2138 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于时空特征融合深度学习的NXNSAttack流量识别方法

IKEChecker：语法引导的IKE协议有状态模糊测试

针对5G核心网协议的自动化漏洞挖掘方法