作为应用最为广泛的程序漏洞挖掘技术，模糊测试一直以来都非常受系统安全研究人员的关注，也有越来越多的人尝试用该技术对网络协议服务器进行测试。在众多网络协议服务器之中，网络设备VPN服务的安全性尤其值得关注，因为VPN服务通常作为内部网络的入口对外开放。然而，现有的模糊测试技术对于网络设备的VPN服务来说效果并不理想，主要有以下两方面原因：一是VPN协议通常情况下需要多阶段的状态转移和加密，现有的基于随机变异和覆盖率反馈的模糊测试技术很难发现VPN协议深层次的漏洞；二是大部分网络设备系统环境较为封闭，很难通过源代码或者二进制程序的插桩来获取代码覆盖率或探究程序状态机。在本文中，作者提出了ALFuzzer，一种基于状态机推断的黑盒模糊测试工具，用来挖掘网络设备在实现IKEv2协议时的程序漏洞。ALFuzzer首先依托主动学习算法，根据用户输入的消息类型，通过成员查询和等价查询的方式推断出目标设备在实现IKEv2协议时的状态机模型，之后以之为引导，对目标设备开展基于黑盒的模糊测试，挖掘设备在实现IKEv2协议时的程序漏洞。最终，ALFuzzer 在4台网络设备中挖掘出6个程序漏洞，均可导致目标设备的IKEv2服务崩溃，部分漏洞可以导致设备重启，造成拒绝服务。
As the most widely used vulnerability discovery technique, fuzzing attracted security researchers. With this technique, there are more and more attempts to find bugs in network protocol implementations. Among many network protocol servers, the security of VPN services on network devices is of particular concern because VPN services are usually open to the public as portals to inside networks. However, the existing fuzzing methods do not work well for VPN services on network devices for two main reasons: first, VPN protocols usually require multi-stage state transition and encryption, and existing fuzzing techniques based on random mutation and coverage feedback are difficult to find deep vulnerabilities; second, the system environment of most network devices is relatively closed, and it is challenging to obtain code coverage or explore the program state machine through source code or binary instrumentation. In this paper, we propose ALFuzzer , a black-box fuzzer based on state machine inference, to uncover program vulnerabilities in network devices implementing the IKEv2 protocol. ALFuzzer first relies on an active learning algorithm to infer the IKEv2 state machine model of the target device using membership queries and equivalence queries based on the message types the user inputs. Then ALFuzzer uses the state machine model as a guide to conduct black-box fuzzing on the target device to find the vulnerabilities in the device's implementation of the IKEv2 protocol. Finally, ALFuzzer discovered 6 program vulnerabilities in 4 network devices, all of which can cause the device's IKEv2 service to crash. Some of these vulnerabilities could cause the device to restart, resulting in denial of service attacks.
