提出了一种高效的会话发起协议(SIP)服务器畸形消息测试方法.通过SIP栈源代码静态分析,建立危险库函数与SIP服务器接口的映射关系;通过SIP消息模板和畸形库,生成针对危险库函数的畸形消息集;通过攻击效果分析和变异、继承操作逐代优化畸形消息集,得到具有显著攻击效果的SIP畸形消息测试集.对所提方法的有效性进行了实验验证.
An efficient fuzzing test method for session initiation protocol( SIP) servers was proposed,compared to the conventional method,the generated number of malformed SIP messages was reduced,good attacking result was produced. It establishes mappings between dangerous library functions and interfaces of the SIP server through static source code analysis. It also obtains a set of malformed SIP messages targeting those dangerous functions. Finally,it optimizes the set of malformed SIP messages by analyzing its attack effects and generating better messages through inheritance and mutation operations,and obtains the set of messages having the most notable attack effects. Experiments are carried out to verify the effectiveness of the proposed method.