基于Fuzzing技术的工业网漏洞挖掘技术研究

发布时间：2019-02-12 14:38

【摘要】：随着工业网络和互联网技术的发展,工业网络与传统IP网络的联系越来越紧密。在很多工业网络当中,存在着传统工业网络和IP网络的混合组网方式。传统工业网络和IP网络联系不断紧密的同时,其给工业网络所带来的安全威胁也越来越突出,近年来专门针对工业网络的病毒和木马层出不穷,并且有着愈演愈烈的趋势。因此,利用模糊测试技术(Fuzzing)对工业网络进行漏洞挖掘,提高工业网络安全的安全防护水平,有着极为重要的意义。目前,业界已经存在一些成熟的模糊测试技术框架,这些技术方案可以产生大量有效的测试用例,对各种软件产品和网络设备进行漏洞挖掘。同时,也有一些研究人员将模糊测试技术用于工业网络的漏洞挖掘。但是相对来说,当前的模糊测试技术框架,很多都存在测试用例生成算法效率较低,监控手段不够有效等缺点,无法对工业网络中的业务子网络和控制子网络进行有效的漏洞挖掘。本文在研究工业网络和漏洞挖掘技术的基础之上,分析了工业网络中可能存在的安全漏洞,然后对当前一些主流的模糊测试技术方案进行了改进,设计了一款适用于异构工业网络的漏洞挖掘系统。该系统可以对测试目标进行组合式漏洞挖掘。同时在该系统中,本文提出一种可以对多个协议字段进行多维变异的测试用例生成算法 MFTCG(Multidimensional Fuzzing Test Case Generator),该算法可以针对网络协议当中的各个不同字段进行多维变异,有效地避免遗漏由多维随机变异所触发的安全漏洞。并且,该系统能够对测试用例进行有效的筛选,提高生成效率。根据测试目标的不同,本文所设计的漏洞挖掘系统软件模块可以采取不同的监控手段对测试目标进行监控。将该系统软件模块部署在工业网络当中实测时,成功发现了文件服务器和工业协议转换网关中存在的多个安全漏洞。如果,这些漏洞被攻击者利用,将会造成机密资料丢失,工业控制网络无法正常运转等严重后果。本课题由工信部电子发展基金支撑,目前所设计的基于Fuzzing技术的工业网漏洞挖掘系统软件模块,已经通过由合作方组织的国家认证的权威通信安全软件机构的测试和第一阶段的验收。并已发表相关论文一篇《基于Fuzzing技术的工业网络漏洞挖掘技术研究》,同时参与申请专利一项。随着IP基础网络与工业网络的日益融合,异构网络安全问题日益凸现,漏洞挖掘作为一种有效的安全防护技术,将会在工业网络安全领域得到更深入的应用,本文在这一方面做出了一些有益的尝试,并且取得了一定的阶段性成果。
[Abstract]:With the development of the industrial network and the Internet technology, the connection between the industrial network and the traditional IP network is becoming more and more compact. In many industrial networks, there are mixed networking modes of the traditional industrial network and the IP network. Compared with the traditional industrial network and the IP network, the security threat brought by the industrial network is also becoming more and more prominent, and in recent years, the virus and the trojan which are specifically targeted to the industrial network are in an endless form, and the trend is more and more intense. Therefore, it is of great significance to exploit and improve the security protection level of industrial network by using the fuzzy test technique to exploit the industrial network. At present, there are some mature fuzzy test technology frameworks in the industry, which can generate a large number of valid test cases, and exploit the vulnerability of various software products and network equipment. At the same time, some researchers have used the fuzzy test technology to exploit the vulnerability of industrial networks. but relatively, the current fuzzy test technical framework has the defects that the test case generation algorithm is low in efficiency, the monitoring means is not effective and the like, and the service sub-network and the control sub-network in the industrial network cannot be effectively exploited. Based on the research of the technology of industrial network and vulnerability, this paper analyzes the possible security holes in the industrial network, and then improves the current fuzzy test technology scheme, and designs a vulnerability mining system suitable for heterogeneous industrial networks. The system can carry out combined vulnerability mining on the test target. At the same time, in this system, a test case generation algorithm (MFTCG), which can multi-dimensional variation of a plurality of protocol fields, can be used for multi-dimensional variation of each different field in a network protocol, the security vulnerabilities triggered by the multi-dimensional random variation are effectively avoided. and the system can effectively filter the test cases and improve the generating efficiency. According to the different test target, the system software module designed in this paper can monitor the test target by different monitoring means. when the system software module is deployed in the industrial network, a plurality of security holes existing in the file server and the industrial protocol conversion gateway are successfully discovered. If these vulnerabilities are exploited by an attacker, it will result in the loss of confidential information, the inability of the industrial control network to function properly, and the like. The project is supported by the Electronic Development Fund of the Ministry of Engineering and Communication, and the software module of the industrial network vulnerability mining system based on the Fuzzying technology has been designed and accepted in the first phase of the test and the first phase of the State-certified authoritative communication safety software mechanism organized by the partner. and has published a paper on the technical research of industrial network vulnerability mining based on Fuzzying technology, and is also involved in a patent application. With the increasing integration of the IP base network and the industrial network, the problem of heterogeneous network security is becoming more and more prominent, and the exploitation of the vulnerability as an effective security technology will be applied in the field of industrial network security. and a certain stage result is obtained.
【学位授予单位】：北京邮电大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】