Key Technologies Research On Protocol Handler Semantic-Analysis Based Network Protocol Testing

With the widespread use of computer network and various network terminals, network is becoming closer to people's life. So network security has also been paid more attention. Network protocol is the core of the network application's function logic. However, network protocol vulnerabilities are very common. Bugs like "Heart Bleed", "Venom" have already caused the security crisis of the whole Internet. Thus the importance of an efficient network protocol testing is obvious.The key of network protocol testing is to test the consistency, namely whether the protocol implementations are consistent with their design specifications. But the network protocol testing is real y complex. Firstly, covering all branches of the protocol handler is a combinator ia l explosion. Then, testcases must conform the message format specification of network protocols. On the other hand, the existing protocol test methods, such as formal verification, protocol fuzzing and protocol handler analysis based methods have some defficencies. For formal verification, it is difficult to ensure the accuracy of protocol implementation models we have inferred. While fuzzing is of great blindness when generating testcases. Existing protocol handler analysis based methods rely on the information of function cal s related to operating system, thereby having a bad cross-platform applicability. Furthermore, since the protocol testing requires each branch or state protocol handler repeatedly tested, they need frequent rollback. The states of memories and harddisk should be recorded. Existing methods are inefficient when recording and replaying these states, which leads to a bad performance in automatic protocol testing.This paper designs and implements a protocol testing method based on the structural analys is of protocol handler. Our work avoids the dependence of the certain operating system platforms. By introducing an incremental snapshot file system, we greatly enhance the efficiecncy of protocol state storage and recovery. Meanwhile, it also improves the performance of automatic network protocol testing. The main contents of this work include the following:1) We analyse network protocol handlers by structural analysis. By binding different control structures and protocol message fields, we could devide the protocol message and infer the semantics of different fields. After that, we also collect the constraints conditions influenced by protocol message taints. Thus we can generate testcases and do protocol testing.2) We extend dynamic taint tracking to multi protocol execution entities. By recording the regular taint tracking model in protocol commucation, we could monitor unusual tracking models thus finding some protocol vulnerabilities like information leaks.3) We design and implement an incremental snapshot file system. We use distributed KeyValue database as the underlying storage engine. The hierarchical data model of protocol execution state snapshot is efficiently mapped to the key-value data Model. In order to enhance the protocol state storage and recovery efficiency, we use interval tree to accerlerate locating increme nt a l snapshots. The file systems greatly enhance the efficiency of automatic protocol testing.4) We use these technologies in our network protocol testing platform Pro Test. We also use the platform to test some real network protocol and find real vulnearabilities thus verifying the effectiveness of our method.