一句话：提出非侵入式日志引导的协议模糊测试器 Logos，通过语义覆盖率指导发现协议实现漏洞。
网络协议广泛部署，其实现的安全性至关重要。传统协议模糊测试常需插桩目标程序，具有侵入性、开销大且难以用于黑盒场景。本文提出 Logos，利用非侵入式运行时日志进行引导。它先将非结构化日志标准化并嵌入高维向量空间形成语义表示，再过滤语义表示并动态维护语义覆盖率，为模糊测试提供定制引导。作者在八种知名协议的广泛使用实现上评估 Logos。24 小时内，其分支覆盖率比现有侵入式或专家知识驱动的协议模糊测试器高 26.75%–106.19%，并发现 12 个安全关键漏洞，其中 9 个获得 CVE 编号。
Network protocols are extensively used in a variety of network devices, making the security of their implementations crucial. Protocol fuzzing has shown promise in uncovering vulnerabilities in these implementations. However traditional methods often require instrumentation of the target implementation to provide guidance, which is intrusive, adds overhead, and can hinder black-box testing. This paper presents Logos, a protocol fuzzer that utilizes non-intrusive runtime log information for fuzzing guidance. Logos first standardizes the unstructured logs and embeds them into a high-dimensional vector space for semantic representation.Then, Logos filters the semantic representation and dynamically maintains a semantic coverage to chart the explored space for customized guidance.We evaluate Logos on eight widely used implementations of well-known protocols. Results show that, compared to existing intrusive or expert knowledge-driven protocol fuzzers, Logos achieves 26.75%-106.19% higher branch coverage within 24 hours. Furthermore, Logos exposed 12 security-critical vulnerabilities in these prominent protocol implementations, with 9 CVEs assigned.
DOI 原文 ·
@inproceedings{paperbot8474,
title = {Logos: Log Guided Fuzzing for Protocol Implementations},
author = {Feifan Wu and Zhengxiong Luo and Yanyang Zhao and Qingpeng Du and Junze Yu and Ruikang Peng and Heyuan Shi and Yu Jiang},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3680394}
}