| With the rapid development of the Internet,distributed systems have become the current mainstream architecture of the Internet due to their obvious advantages in distribution,resource sharing,and scalability.The application of distributed systems involves various fields of society,and its security issues affect people’s lives and property,and it is very important to discover the security issues in the distributed systems in time.Fuzzing is one of the most effective automated methods to find security problems in the system.Therefore,it is very important to study the method of fuzzing distributed systems to discover their security problems.Fuzzing of distributed systems is a type of network protocol testing(remote access service).At present,there are mainly two kinds of fuzzing for network protocols: clientside and server-side test modes or network intermediate device mode.Among them,the client-side and server-side test modes mainly uses Fuzzer and the target system as the two endpoints of the test process,but when the target system has complex calling logic,it cannot be directly used as an endpoint test;the network intermediate device mode mainly tests intermediate devices such as routers and security gateways,and considers less the security problems of the target system itself.Aiming at various problems of the existing methods,this paper takes into account the complex characteristics of distributed systems itself and the dynamic nature of the operating environment,and proposes a framework for the distributed system fuzzing.The main work of this article is as follows:(1)Based on the traditional system’s fuzzing framework as the theoretical basis,the distributed system’s fuzzing framework is proposed.The framework is mainly divided into system analysis stage and fuzzing stage.In the system analysis stage,on the one hand,input seeds are constructed according to the system architecture and functions,on the other hand,drivers are introduced.In the fuzzing stage,fuzzing is performed using fuzzer,combined with the input seeds parsed in the drivers and the interfaces that call subsystems in the distributed system,and dynamically monitoring exceptions in the distributed system.Finally,output abnormal information.(2)The fuzzing framework of the distribued system is designed.Among them,the system analysis stage includes: design input seed format files to construct input seeds;design drivers to make they have the function of parsing input seeds and calling the interface of each subsystems in the distributed system.The fuzzing stage includes: on the basis of Kelinci algorithm,the algorithm of DSKelinci is proposed,which combines the drivers and input seeds to realize the function of instrumentation and fuzzing of the distributed system.(3)Visualize the results of the fuzzing.Dynamically monitor the abnormal state of distributed system operation and capture abnormal data for analysis to provide data support for vulnerabilities analysis.(4)Using static testing and fuzzing comparative analysis,the open source distributed system Train Ticket developed by Fudan University was used for experimental verification.Finally,fuzzing successfully found 23 vulnerabilities,while static testing only found 3 vulnerabilities,which successfully verified the validity and correctness of the distributed system framework of the distributed system. |
