Finding protocol manipulation attacks
Finding protocol manipulation attacks
复制标题
查找协议操纵攻击
DOI：
--
复制
发表时间：
2011
期刊：
影响因子：
--
通讯作者：
M. Musuvathi
中科院分区：
文献类型：
--
作者：
Nupur Kothari;Ratul Mahajan;T. Millstein;R. Govindan;M. Musuvathi
我们开发了一种方法来帮助发现协议实现中的操纵攻击。在这些攻击中，攻击者通过歪曲其意图或网络条件来诱导诚实的节点表现出不良行为。我们的方法是基于静态分析与符号执行和动态分析与具体执行的新组合。前者查找可能易受攻击的代码路径，后者模拟导致有效攻击的对抗性操作。我们的方法是精确的(即没有误报)，并且我们表明它可以扩展到复杂的协议实现。我们将其应用于四种不同的协议，包括Tcp、802.11 MAC、ECN和SCTP，并表明它能够发现这些协议之前报告的所有操纵攻击。我们还发现了以前未报告的针对SCTP的攻击。此攻击是TCP攻击的变体，但由于两种协议之间存在细微的语义差异，因此必须在SCTP中以不同的方式安装。
We develop a method to help discover manipulation attacks in protocol implementations. In these attacks, adversaries induce honest nodes to exhibit undesirable behaviors by misrepresenting their intent or network conditions. Our method is based on a novel combination of static analysis with symbolic execution and dynamic analysis with concrete execution. The former finds code paths that are likely vulnerable, and the latter emulates adversarial actions that lead to effective attacks. Our method is precise (i.e., no false positives) and we show that it scales to complex protocol implementations. We apply it to four diverse protocols, including TCP, the 802.11 MAC, ECN, and SCTP, and show that it is able to find all manipulation attacks that have been previously reported for these protocols. We also find a previously unreported attack for SCTP. This attack is a variant of a TCP attack but must be mounted differently in SCTP because of subtle semantic differences between the two protocols.