摘要
Abstract
Amplification-based distributed denial of service(ADDoS)attacks have posed a persistent and severe threat to the Internet.Recent incidents revealed that these attacks not only generated substantial traffic but also ex-ploited a diverse range of protocol types,with amplification vulnerabilities being identified as a primary cause.Tra-ditionally,known amplification vulnerabilities were discovered either through empirical knowledge or by analyzing traffic from amplification attack incidents,highlighting a lack of proactive methods for identifying such vulnerabili-ties.Existing approaches,such as AmpFuzz,were limited to focusing solely on amplification patterns for individual requests and were restricted to the UDP protocol,which constrained their applicability.To address these limitations,a state-guided method for mining amplification vulnerabilities,referred to as AFLAMP,was proposed.This method leveraged protocol state to guide fuzz testing and employed session-based bandwidth amplification coefficients for seed selection,thereby enhancing the effectiveness of vulnerability discovery.Experimental results demonstrate that AFLAMP successfully identifies amplification vulnerabilities,uncovering 11 vulnerabilities in five services known to be susceptible(OpenTFTP,OpenSLP,NTP,Memcached,and Dnsmasq),including six previously unknown vul-nerabilities.Compared to AmpFuzz,AFLAMP achieves 37.5%increase in the detection rate of vulnerabilities.Addi-tionally,AFLAMP identifies 12 amplification vulnerabilities in a TCP-based service program(LightFTP).关键词
DDoS攻击/流量放大/模糊测试/协议状态/漏洞挖掘Key words
DDoS attack/traffic amplification/fuzz testing/protocol state/vulnerability discovery分类
信息技术与安全科学
