Abstract:Network protocol fuzzing tries to test the robustness of a protocol implementation through exploring the infinite amount of possible anomalous inputs to find the tests that cause invalid behaviors. Therefore, protocol fuzzing is regarded as security testing, since it is essential to prove robustness in networks. Although many good practices have been done to improve protocol fuzzing, problems in automated test case generation are still unsolved. Traditional methods using formal language and protocol specification have evident defects, especially in close networks. In order to provide useful references for test data generation, protocol reverse engineering becomes a suitable solution. But approaches adopted during the last decades cost much in computational complexity and time consumption. To break through these limitations, this paper proposes a novel message matrix perturbing mode to generate test case through data mutation for application layer protocol. It is established on the basis of the mapping relationship according to ASCII code. After the conversion from a protocol message to an integer matrix, meta-perturbations can be conducted to generate test data in all syntax levels, which preserves the flexibility in complex mutating combinations. Additionally, a new statistical keyword extracting technique with priority recursive splitting pattern is introduced to provide useful information for intelligent data mutation. Finally, we evaluate the method on HTTP request message. With the transformed message matrix and corresponding keyword reference, test cases examples for protocol fuzzing are generated through perturbing process with the combination of meta-operations. Fairly good outcomes are achieved which illustrate the feasibility and efficiency of the work in this paper.

Brute Force Vulnerability Testing Technology Based on Data Mutation

An Efficient Mutation-Based Fuzz Testing Approach for Detecting Flaws of Network Protocol

Improved Vulnerability Testing Mode Based on Syntax Analysis and Regular Expressions Test Cases Generation

A Mutation-Based Fuzz Testing Approach For Network Protocol Vulnerability Detection

Integrated TCP/IP protocol software testing for vulnerability detection

Adaptive IP Mutation: A Proactive Approach for Defending against Worm Propagation

Fuzzing Test Data Generation Based On Message Matrix Perturbation With Keyword Reference

A Protocol Security Testing Method Using Mutation Analysis

A model guided security vulnerability discovery approach for network protocol implementation

State Machine Mutation-based Testing Framework for Wireless Communication Protocols

A Self-Revised Method of Protocol Identification Using Mutation Test

An Automatic Fuzz Testing Method Designed For Detecting Vulnerabilities On All Protocol

A Hybrid Vulnerability Analysis Method Against Non-Security Protocols.

Mutation Testing of Protocol Messages Based on Extended TTCN-3

Algorithm for discovering SNMP protocol vulnerability

Protocol vulnerability detection based on network traffic analysis and binary reverse engineering

Model-Based Grey-Box Fuzzing of Network Protocols

Vulnerability Testinh of WAP Based on Extended Syntax Analysis

Constructed Type Algebra Based Protocol Security Testing Method

A Penetration Testing Method for E-Commerce Authentication System Security

Security Testing Tool in SIP-Based VoIP System