A Hybrid Vulnerability Analysis Method against non-Security Protocols

摘要

A hybrid analysis method for protocol is proposed which combines the power of both manual and automatic methods. At first, it defines a number of attack goals and then studies how to achieve these goals by misusing the messages. An automatic analysis tool is applied in order to reach completeness based on the manual analysis. Some of the found attacks are excluded because of the low feasibility in the practical environment, and the other feasible attacks might be combined to launch more powerful compound attacks. Some vulnerability is found when applying the hybrid method to check mobile IPv6 protocol. The result shows the hybrid method is a systematic method with completeness guarantee. It fits for analyzing non-security protocols and finding the subtle vulnerability.