SPIDER：面向ONOS软件定义网络控制器中有状态性能问题的模糊测试
SPIDER: Fuzzing for Stateful Performance Issues in the ONOS Software-Defined Network Controller
AI总结：
本文提出SPIDER模糊测试框架，利用ONOS控制器的事件驱动模块化架构和静态依赖分析，针对157个网络服务识别有状态性能问题，发现10个新性能缺陷。
摘要：
软件定义网络（SDN）控制器中的性能问题可能对网络的性能和可用性产生严重影响。本文考虑一类特殊的SDN漏洞，称为有状态性能问题（SPIs），其中一系列初始输入消息将控制器驱动到某种状态，使得其在处理后续消息时性能出现病态退化。在诸如广泛使用的ONOS SDN控制器这样的大型复杂软件中发现SPIs具有挑战性，原因在于输入序列的状态空间巨大，以及相互依赖的网络服务构成的复杂软件架构。我们提出SPIDER，一个用于在此场景下识别SPIs的实用模糊测试框架。我们工作的关键贡献是利用SDN控制器的事件驱动模块化软件架构，以（a）分别针对每个网络服务进行SPIs测试，以及（b）使用静态分析识别所有其事件处理器能够直接或间接影响目标服务状态的服务。SPIDER为ONOS中的157个网络服务实现了这种新颖的依赖感知模块化性能模糊测试方法，并成功识别出10个新的性能问题。我们给出了SPIDER与先前工作的对比评估、设计决策的敏感性分析，以及两个已发现SPIs的案例研究。
英文摘要：
Performance issues in software-defined network (SDN) controllers can have serious impacts on the performance and availability of networks. In this paper, we consider a special class of SDN vulnerabilities called stateful performance issues (SPIs), where a sequence of initial input messages drives the controller into a state such that its performance degrades pathologically when processing subsequent messages. Uncovering SPIs in large complex software such as the widely used ONOS SDN controller is challenging because of the large state space of input sequences and the complex software architecture of inter-dependent network services. We present SPIDER, a practical fuzzing framework for identifying SPIs in this setting. The key contribution in our work is to leverage the event-driven modular software architecture of the SDN controller to (a) separately target each network service for SPIs and (b) use static analysis to identify all services whose event handlers can affect the state of the target service directly or indirectly. SPIDER implements this novel dependency-aware modular performance fuzzing approach for 157 network services in ONOS and successfully identifies 10 new performance issues. We present an evaluation of SPIDER against prior work, a sensitivity analysis of design decisions, and case studies of two uncovered SPIs.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
